2012-01-12

Apache 隱藏 header 的方法

原本的 header 如下:

curl -I http://localhost
HTTP/1.1 200 OK
Date: Mon, 09 Jan 2012 08:55:09 GMT
Server: Apache/2.0.59 (FreeBSD) PHP/4.4.4 with Suhosin-Patch mod_ssl/2.0.59 OpenSSL/0.9.7e-p1
Last-Modified: Mon, 07 Mar 2011 18:36:38 GMT
ETag: "cabcb3-180-c6ac5980"
Accept-Ranges: bytes
Content-Length: 384
Connection: close
Content-Type: text/html
隱藏的設定:
編輯httpd.conf:
ServerTokens = Full,也就是所有的資訊都會公佈,改成
ServerTokens = Prod
ServerSignature = On,改成
ServerSignature = Off
編輯php.ini
expose_php = On,改成
expose_php = Off
重新啟動Apache

改完之後
curl -I http://localhost
HTTP/1.1 200 OK
Date: Mon, 09 Jan 2012 08:51:41 GMT
Server: Apache
Last-Modified: Mon, 07 Mar 2011 18:36:38 GMT
ETag: "cabcb3-180-c6ac5980"
Accept-Ranges: bytes
Content-Length: 384
Connection: close
Content-Type: text/html