Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

The HTTP response header for Blog Overflow does not give a Server: string at all, assumably for (slight) security benefit. However, it does include an X-Powered-By: PHP/5.3.3 header, and also supports the PHP easter egg URLs. You probably want to set expose_php to false.

share|improve this question
Even my bank does not hide that information... (Seam Framework, IBM HTTP Server, Windows 2003.) – Arjan Apr 21 '12 at 22:07
@Arjan: When it comes to security, you probably want to do everything exactly opposite of most banks. – Cody Gray Apr 21 '12 at 23:40
@TheEstablishment nonsense, I look forward to SO having a max length limit on passwords – Ben Brocka Apr 22 '12 at 0:03
Jokes aside, I thought we were done hiding stuff that like that. Why not give the PHP community some credits? Headers like X-Powered-By and Generator have their merits, and they are the least intrusive for the website owner. – Arjan Apr 22 '12 at 10:12
I seem to be missing the point here -- how exactly is this a security issue? What would be the point of hiding it? – balpha Apr 25 '12 at 8:06
@balpha Someone decided to hide the the Apache name/version/platform. They probably did this to make targeting vulnerabilities in a particular apache version harder. So, its inconsistent (and looks like a mistake) to not hide the PHP one (especially since PHP likely has far more vulnerabilities than Apache). – derobert Apr 25 '12 at 16:19
@derobert we did no special config to hide those, its probably a rhel/centos defaut for the httpd package – Zypher Apr 26 '12 at 3:18
up vote 3 down vote accepted

Security by obscurity is a broken concept. Attackers don't waste time with a version check anyway – they just send their malicious code with the first request.

Hiding the PHP version would not make the blog more secure. You save some bytes during the request, but that's all.

share|improve this answer
We have people trying to exploit Apache and PHP issues on Stack Overflow all the time, which runs on IIS and ASP.NET MVC. Talk about not wasting time with a version check :) – balpha Apr 25 '12 at 20:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .