Guides

Secure Nginx Config: Hide Server Version and Powered-By Headers

By Ravindra Bagale, Cyber Security trainer · LinkedIn · Published: 27 October 2026 · Last updated: 27 October 2026

To hide the Nginx version, set server_tokens off; in nginx.conf, test with nginx -t, and reload. Remove X-Powered-By in PHP (expose_php = Off) or with an Nginx header directive. Fingerprinting still happens, but you stop giving free version numbers.

sudo sed -n "1,80p" /etc/nginx/nginx.conf | head
# inside http { } block:
#   server_tokens off;
sudo nginx -t && sudo systemctl reload nginx
curl -I https://YOUR_SITE

Why hide version headers?

Tools like WhatWeb read Server and X-Powered-By. A clear nginx/1.18.0 or PHP/7.4 speeds up exploit searches. You cannot hide everything, but you can stop handing out the version for free.

What are you changing?

server_tokens controls whether Nginx prints its version. PHP expose_php controls X-Powered-By. Both are small config edits on your server.

How do I do it step by step?

1. On your EC2 or VPS, open the main config:

   sudo nano /etc/nginx/nginx.conf

   What it means: Amazon Linux and Ubuntu both use this file as the main entry.

2. Inside the http { } block add:

   http {
       server_tokens off;
       # ... existing lines
   }

3. Test and reload:

   sudo nginx -t && sudo systemctl reload nginx

   nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
   nginx: configuration file /etc/nginx/nginx.conf test is successful

   What it means: Syntax is good and Nginx reloaded without dropping the whole server.

4. For PHP-FPM, set in the active php.ini:

   expose_php = Off
   # then: sudo systemctl reload php-fpm   # name may be php8.2-fpm

   What it means: PHP stops sending X-Powered-By on responses.

5. Verify from your laptop:

   curl -I https://YOUR_SITE

   HTTP/2 200
   server: nginx
   # no nginx/1.x and no x-powered-by

   What it means: Server no longer advertises a version string. Good.

Next, add security headers (see the curl guide) and work through the website security checklist.