yum upgrades for production use, this is the repository for you.
Active subscription is required.
📅 Updated: January 28, 2026 (Originally published: June 24, 2018)
Security through obscurity isn’t the holy grail that will make your website secure completely. But it doesn’t mean you shouldn’t use it. As a complementary security measure, it must be used.
NGINX, by default, sends information about its use in the Server HTTP header as well as error pages, e.g.: nginx/1.26.2.
To confirm the currently emitted header, run in your terminal:
curl -IsL https://example.com/ | grep -i server
Hide Version Information
The standard security solution is hiding NGINX version information. In your nginx.conf:
http {
server_tokens off;
}
This hides the specific version from the Server header and error pages. The header becomes:
Server: nginx
However, it’s much better to remove the Server header completely.
Remove the Server Header Completely
You can achieve this using third-party modules from the GetPageSpeed repository.
Using ngx_security_headers Module
The security-headers module provides a simple directive to hide the server token completely:
For Rocky Linux, AlmaLinux, CentOS 8/9, or Fedora:
sudo dnf install -y https://extras.getpagespeed.com/release-latest.rpm
sudo dnf install -y nginx-module-security-headers
For CentOS/RHEL 7:
sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
sudo yum -y install nginx-module-security-headers
Note: An active NGINX Extras subscription is required for RHEL-based systems. Fedora users have free access.
Enable the module and configure it in your nginx.conf:
load_module modules/ngx_http_security_headers_module.so;
http {
hide_server_tokens on;
}
The Server header is completely eliminated from responses.
Using Headers-More Module
The headers-more module provides flexible header manipulation:
For Rocky Linux, AlmaLinux, CentOS 8/9, or Fedora:
sudo dnf install -y https://extras.getpagespeed.com/release-latest.rpm
sudo dnf install -y nginx-module-headers-more
For CentOS/RHEL 7:
sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
sudo yum -y install nginx-module-headers-more
Configure in your nginx.conf:
load_module modules/ngx_http_headers_more_filter_module.so;
http {
more_clear_headers Server;
}
The Server header will be completely removed from responses.
Hide NGINX Presence Entirely
Removing the Server header is good, but NGINX’s default error pages still output the “nginx” word.
Option 1: Use NGINX-MOD (Recommended)
NGINX-MOD is an enhanced NGINX build that supports complete hiding:
server_tokens none;
Only NGINX-MOD supports the none value for the server_tokens directive. This removes “nginx” from both the header and error pages.
Option 2: Custom Error Pages
Create custom error pages that don’t mention NGINX:
server {
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /var/www/error_pages;
internal;
}
}
Option 3: Source Code Modification (Not Recommended)
You can hide NGINX presence by recompiling from source (discouraged – see common pitfalls).
Verify the Server Header Is Removed
Test your configuration:
curl -IsL https://example.com/ | grep -i server
If configured correctly, there should be no output (no Server header present).
Additional Security Headers
While removing the Server header, consider adding security headers to improve your site’s security posture. See our guides on:
- NGINX HSTS configuration for transport security
- NGINX TLS 1.3 hardening for SSL/TLS configuration
dzam
I am not a server admin and do not have access to nginx.conf, can something similar be done in php.ini?
Danila Vershinin
It requires editing the NGINX configuration.
Bragi Austfjörð
Can I use this for plesk centos 8
Danila Vershinin
I think every article here can’t be updated to account for Plesk (mostly the instructions are for panel-less setups),
but Plesk modules deserve their dedicated page, which I have set up here.
From there I hope it will be clear how to install/enable NGINX modules for Plesk, for example:
Essentially for every tutorial on the website about NGINX modules, prefix NGINX module package name with
sw-(that gives you the name of Plesk-compatible NGINX module package), and use the Plesk way of enabling the module instead of addingload_module ...tonginx.conf.Note that not every NGINX module from the base repository is available for Plesk, but most are.
Bragi Austfjörð
Thanks for your reply. I really appreciate that. Yeah I agree not all blog post can work for plesk hehe but I had to ask 🙂
bragiaustfjordBragi Austfjörð
I tried and I have this error.
Danila Vershinin
Please run
dnf clean alland try again.Anonymous
Hi Danila,
I tried to run:
sudo yum -y install nginx-module-security-headers
or
sudo yum -y install nginx-module-headers-more
but both resulted to:
No package nginx-module-security-headers available.
No package nginx-module-headers-more available.
respectively. I’m using RHEL 7, do I have to install before this?
Thanks.
Danila Vershinin
For packaged installation, you need to be an active commercial subscriber, and follow-through repository setup, which is essentially: