I have seen on internet where several website companies have exposed the default home page of web server such as Tomcat, NGNIX, Apache web server. I always believe it is not the best practice to expose default web server page. But now a days most of the web-servers avoid any sensitive information in home page. So at present is there any issue in exposing default web server pages to internet?

Exposure of these details allow attackers to conduct enumeration, which is the process to extract and obtain information of targets in order to launch future attacks. For example, knowing the PHP version that is running on a particular server allows an attacker to find what vulnerabilities are on that particular version that could be exploited, providing that these have not been patched. This is just a simplistic example of enumeration.

There are website resources out there that discuss this in further detail, the techniques used to enumerate various information, and so on.

Welcome to Stack exchange!

You may not have sensitive information but you will expose platform running behind the web service (You have also identified some of the platforms running - Tomcat, NGNIX, Apache web serve, etc based on your search)

By knowing the platform the hackers/attackers could send targeted attacks using the known vulnerabilities of those platforms (easy reconnaissance for attackers).

Hence It's always recommended to hide the default web page.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.