Response · Response header

Server

Identifies the server software.

What is Server?

Purely informational — and mildly a security leak (it advertises your stack). Many hardened servers strip or fake this header.

Optional. Often stripped in production.

Server: nginx/1.25.3

Attackers use Server headers for reconnaissance. Consider removing it on production.

RFC 9110 §10.2.4

What is the Server HTTP header?

Purely informational — and mildly a security leak (it advertises your stack). Many hardened servers strip or fake this header.

Is Server a request or response header?

Server is a response header — the server sends it to the client. Optional. Often stripped in production.

What does a Server header look like?

A typical Server header looks like: Server: nginx/1.25.3.

What are common mistakes with Server?

Attackers use Server headers for reconnaissance. Consider removing it on production.

Location

The redirect target (3xx) or newly created resource URL (201).

Retry-After

How long the client should wait before retrying.

Date

When the response was generated.

Allow

Which HTTP methods the target resource supports.

Link

Serialized <link> relationships as an HTTP header.