need to hide server details using apache server whenever there is 404 or 403 error [closed]

Question

I need need to hide server details using apache server whenever there is 404 or 403 error.

I tried with the below two changes in httpd.conf file.

    ServerSignature Off 
    ServerTokens Prod 

However , still Im seeing the server details whenever there is a 404 or 403 error.Do I need to have any module installed for this to work.

Note: Im using Windows 7.

Answer 1

Try creating some custom error response pages. A plain old HTML page that just says something along the following lines:

ERROR 403: You are not authorised to access this resource.

It doesn't even need any formatting.

Answer 2

Can't tell if that's a typo or not. But you wrote ErrorDocument 403 'not found'. Remember that each of the various error messages corresponds to a different condition. So, for example, Error 403 is not the error that happens when someone looks for a URL that doesn't exist. Error 404 is what is transmitted in that case. If you really want to override ALL of the error messages, then you need a complete and comprehensive list. According to Google, the most common HTTP errors that people encounter (and thus the most important for anonymising—assuming anonymising is worth doing) are these:

• 500 Internal Server Error
• 404 Not Found
• 403 Forbidden
• 401 Unauthorised
• 400 Bad Request

You'll need at least 5 distinct lines in your httpd.conf file, one for each of these. Something like:

ErrorDocument 500 Error
ErrorDocument 404 Error
ErrorDocument 403 Error
ErrorDocument 401 Error
ErrorDocument 400 Error

You will struggle to test some of these. Error 404 is trivial to test. The others require a bit of configuring before you could set up a test case.