How to fix info disclosure server on Headless / Custom (I build in code)

Steps for Headless / Custom (I build in code)

1. For *nginx*: in `nginx.conf` inside the `http {}` block, add `server_tokens off;`. For a fully blank header, install the `headers-more-nginx-module` and add `more_clear_headers Server;` or `more_set_headers 'Server: ';`.
2. For *Apache*: in `httpd.conf` or the relevant VirtualHost config, set `ServerTokens Prod` and `ServerSignature Off`. To completely remove the header, use `mod_headers`: `Header unset Server`.
3. For *Node.js / Express*: call `app.disable('x-powered-by')` and, for the `Server` header if set by a reverse-proxy, handle it at the proxy layer. Use the `helmet` package (`app.use(helmet())`) which removes `X-Powered-By`; remove `Server` at the nginx/load-balancer layer.
4. For *Cloudflare (any stack)*: Rules > Transform Rules > Modify Response Header > Add Rule > Remove header named `Server`. No server access required.
5. For *AWS CloudFront*: use a CloudFront Function or Lambda@Edge on the `viewer-response` event to delete the `Server` header from the response before it reaches the client.
6. Verify: `curl -I https://yourdomain.com` — `Server` header should be absent or generic.

What is info disclosure server?

Every time a visitor's browser (or a hacker's scanner) requests a page from your store, your web server sends back a collection of HTTP headers alongside the page content. One of these is the `Server` header — for example, `Server: nginx/1.25.5` or `Server: Apache/2.4.58 (Ubuntu)`. This header broadcasts exactly which server software you are running and, critically, which version. It is visible to anyone using a browser's developer tools, a command-line tool like `curl`, or an automated vulnerability scanner. Hiding or removing it takes only a small configuration change and immediately stops your server from volunteering this information.

Attackers routinely scan millions of websites, harvest version numbers from `Server` headers, and then look up known CVEs (publicly disclosed vulnerabilities) for that exact software version. If your server announces `nginx/1.25.5`, a malicious actor instantly knows which published exploits to try — no guesswork required. Removing the header does not make your server invulnerable, but it eliminates the easiest first step in a targeted attack, increasing the cost and effort for an adversary. This is classified under OWASP A05:2021 Security Misconfiguration — one of the most common causes of real-world breaches. Beyond security, some enterprise procurement and compliance processes (PCI-DSS, ISO 27001) explicitly flag verbose server banners as a finding that must be remediated before certification.

See the complete Info disclosure server guide for every platform and the full background.