I need need to hide server details using apache server whenever there is 404 or 403 error.

I tried with the below two changes in httpd.conf file.

    ServerSignature Off 
    ServerTokens Prod 

However , still Im seeing the server details whenever there is a 404 or 403 error.Do I need to have any module installed for this to work.

Note: Im using Windows 7.

  • 2
    This is called web server fingerprinting, OWASP has a section about this owasp.org/index.php/Fingerprint_Web_Server_(OTG-INFO-002) Basically, how the server responds to different requests and the headers and the order in which they are sent help identify a web server.
    – Purefan
    Commented Jan 28, 2016 at 8:51
  • 1
    Sure Purefan, I will have a look into it, thanks :)
    – balaji
    Commented Jan 28, 2016 at 11:49

2 Answers 2


Try creating some custom error response pages. A plain old HTML page that just says something along the following lines:

ERROR 403: You are not authorised to access this resource.

It doesn't even need any formatting.

  • hey Philip, thanks for ur reply, now from my side I have added only ErrorDocument 403 “not found” at the end of httpd.conf file, and restarted my server. Still Im seeing the old message only with the server details, do I need to anything else?
    – balaji
    Commented Jan 28, 2016 at 9:04
  • @balaji Check that it isn't configured elsewhere in the httpd.conf file - that might be overriding it.
    – user81469
    Commented Jan 28, 2016 at 9:34

Can't tell if that's a typo or not. But you wrote ErrorDocument 403 'not found'. Remember that each of the various error messages corresponds to a different condition. So, for example, Error 403 is not the error that happens when someone looks for a URL that doesn't exist. Error 404 is what is transmitted in that case. If you really want to override ALL of the error messages, then you need a complete and comprehensive list. According to Google, the most common HTTP errors that people encounter (and thus the most important for anonymising—assuming anonymising is worth doing) are these:

  • 500 Internal Server Error
  • 404 Not Found
  • 403 Forbidden
  • 401 Unauthorised
  • 400 Bad Request

You'll need at least 5 distinct lines in your httpd.conf file, one for each of these. Something like:

ErrorDocument 500 Error
ErrorDocument 404 Error
ErrorDocument 403 Error
ErrorDocument 401 Error
ErrorDocument 400 Error

You will struggle to test some of these. Error 404 is trivial to test. The others require a bit of configuring before you could set up a test case.

  • It is actually possible to just use a string: ErrorDocument "403 HAAAAX! THE HAAAAAAAAAAX" will create a plain empty HTML page with those words, and both single or double quotes are acceptable. So, it's not actually a typo
    – user81469
    Commented Jan 28, 2016 at 10:56
  • 1
    The possible typo was 403 not found versus 404 not found. The OP would have a harder time testing 403 versus 404. And it's entirely possible his test failed because he thought his error 403 should have been coming up, but it wasn't because he was triggering 404s.
    – Paco Hope
    Commented Jan 29, 2016 at 13:07
  • Ah, I thought you meant single quotes vs double quotes.
    – user81469
    Commented Jan 29, 2016 at 13:15

Not the answer you're looking for? Browse other questions tagged .