Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

5
  • Great Answer, although, is there any benefit to exposing this information to the Internet? (public facing web applications) Commented Oct 30, 2012 at 6:28
  • 2
    The benefit is the debugging thing - I do a lot of development work on web services / automation - not every client is a browser with a user driving it. Commented Oct 30, 2012 at 9:55
  • 1
    I could see a use for this in a development environment, but not on internet facing production systems. What benefit does it really provide to an organization to expose this information to the internet? Commented Oct 31, 2012 at 3:30
  • 2
    I think changing the server header to something generic adds a small amount of security at the cost of very little. Administrators and developers already know what software is running on a server, so disabling this information costs nearly nothing. Automated tools don't necessarily just fire and hope, it depends on the expense of the attack. If you want to maximize infection you choose targets wisely rather than spending time on ones that won't work. Commented Feb 11, 2015 at 19:03
  • 1
    Even if the version is current, Knowing when, and how often you apply patches is valuable information. By observing when patches are applied, an attacker will know when your production systems are the weakest. Commented May 5, 2017 at 18:44