Infrastructure and disclosure

Server HTTP Header

Identifies software or services that handled the response on the server side.

Applicability

This field applies to HTTP responses.

Syntax

Server: <product>[/<version>] [(comment)]

Examples

Server: nginx

Common use cases

  • Provide coarse implementation information for diagnostics in a controlled environment.
  • Confirm that a reverse proxy or hosting platform is rewriting origin banners as intended.

Common mistakes

  • Treating an observed banner as reliable proof of the complete origin technology stack.
  • Publishing detailed version information and assuming patch management is no longer necessary after removing it.

Security considerations

Reducing unnecessary version detail can slow opportunistic fingerprinting, but vulnerability remediation and secure configuration are the real controls.

Detailed guidance

Meaning and behavior

Server is an optional response field containing information about software handling a request at the origin server. Its grammar permits one or more product identifiers and comments, but RFC 9110 advises implementations not to expose needless detail. A value such as nginx may describe the component that produced the final response, a front proxy’s chosen banner, or a deliberately generic label. It does not prove that the named product is the only server involved, that the version is current, or that the bytes came directly from the origin.

Reverse proxies, CDNs, managed hosting platforms, and application frameworks can add, replace, or remove the field. Error responses may also be generated by a different layer and reveal another value. Server is therefore diagnostic metadata rather than an authenticated inventory. Its semantics differ from Via, which traces forwarding intermediaries according to HTTP rules.

Implementation notes

Decide whether operational users need this metadata. If not, configure the layer that emits it to omit detailed versions or use a minimal stable product token. Check normal pages, redirects, errors, static assets, and rate-limit responses because each may bypass a central rule. Do not spend effort falsifying a banner while leaving known vulnerabilities unpatched. Maintain an internal asset inventory and version management process independent of public headers. When comparing scanner results, account for the path the scanner takes through CDN and gateway infrastructure, since a browser on another route can observe a different terminating component.

Sources