Hiding your server version: Crawl Audit check 153

Short answer: the Server header names the software answering requests. Adding the exact version makes it easy to match your site against known bugs in that version. Check 153 warns when the header contains a number.

What Crawl Audit checks

• Pass: no Server header.
• Pass: a Server header without digits, such as nginx.
• Warning: a Server header with a version, such as Apache/2.4.58. The report shows it.

What the sources say

• MDN: "The presence of this header in responses, especially when it contains fine-grained implementation details about server software, may make known vulnerabilities easier to detect."
• OWASP: "Remove this header or set non-informative values."
• OWASP also: "Remember that attackers have other means of fingerprinting your tech stack." Hiding the version buys a little; keeping the software updated is the actual fix.

Hiding it

• nginx: server_tokens off;
• Apache: ServerTokens Prod and ServerSignature Off
• On managed hosts and CDNs the header usually names the platform without a version, and you can leave it.

Check error pages too: default 404 and 500 pages often print the server name and version at the bottom.

On devmarde.com

Our responses say Server: Vercel, with no version, so it passes.

Sources

• MDN, Server (updated 17 September 2026).
• OWASP, HTTP Headers Cheat Sheet, checked 6 October 2026.