Apache's default ServerTokens value is Full, so the Server header can reveal the Apache version, operating system and modules. Setting it to Prod trims the header to the product name. That reduces what scanners learn for free, but it does not fix anything. Patching still matters more.
What the defaults are
From the Apache 2.4 core documentation:
| Directive | Default |
|---|---|
| ServerTokens | Full |
| ServerSignature | Off |
| TraceEnable | on |
With Full, the Server header looks like Apache/2.4.2 (Unix) PHP/4.2.2 MyMod/1.2. Other values trim it: OS gives Apache/2.4.2 (Unix), Minimal gives Apache/2.4.2, Minor gives Apache/2.4, Major gives Apache/2, and Prod gives Apache.
The setting applies to the whole server and cannot be changed per virtual host. It also controls what ServerSignature displays.
ServerSignature
When Off, error pages have no footer line. When On, the footer shows the server version and the ServerName of the virtual host. EMail adds a mailto reference to the ServerAdmin address. Since the default is already Off, the usual fix is simply to leave it alone and check nobody turned it on.
TraceEnable
TRACE is a diagnostic method that echoes a request back. The default on permits it per RFC 2616, which disallows a request body. Set to off, Apache returns 405. The extended value is for testing only and allows request bodies up to 64 KB as an origin server. The docs also note TRACE cannot be restricted with Limit or LimitExcept, so TraceEnable is the control to use.
Few modern applications need TRACE. Turning it off removes one more method an attacker can try.
ServerTokens Prod
ServerSignature Off
TraceEnable Off
Does hiding the version help?
A little. A header with an exact version lets an automated scanner match you to known flaws without sending a single probe. Trimming it removes that shortcut and costs nothing.
But treat it as noise reduction. A determined attacker can often identify a server from behavior. And the wrong conclusion is "we hid the version, so we are fine". Apache HTTP Server has had multi-CVE releases, and the way to be safe is to know your version, subscribe to the project's advisories and update. Our post on Apache httpd 2.4.68 shows what such a release looks like.
Other limits worth knowing
The same page lists defaults for request limits: LimitRequestLine 8190 bytes, LimitRequestFields 100, and LimitRequestBody 1073741824 bytes (1 GB) in recent versions. In Apache 2.4.53 and earlier, the body default was 0, meaning unlimited. Check whether your build predates that and set a body limit that fits your application.
Verify
curl -sI https://example.com/ | grep -i '^server'
curl -s -o /dev/null -w '%{http_code}\n' -X TRACE https://example.com/
You want a short Server value and a 405 or similar refusal for TRACE.
Where Safeguard fits
Knowing which Apache or library version you actually run is an inventory problem. Safeguard offers asset discovery, SBOM and dependency scanning and a free scan at https://gold.safeguard.sh/scan.
Quick check
What does ServerTokens Prod send?
Only the product name, Apache, in the Server header.
How do you disable TRACE in Apache?
Set TraceEnable Off. Requests then get a 405 response.
Sources
Last reviewed: 19 October 2026.
