I'm bulding a website but some webtools and browser plugins allows anyone to get information on which technologies the website has been built. Is there any Alternative to not reveal that we are working on server that process php ?
Don't provide any information to anyone unless its absolutely necessary.
You should set
expose_php=off in your PHP.ini. This tells PHP not to expose the "x-powered-by" HTTP header as well as the strange quarks that can be used to identify it. You should also set
display_errors=Off which could be used to identify PHP as well as error-based vulnerabilities like SQL Injection. These two configurations should be used on all production systems. You can go a step further and remove or change the .php extension with mod_rewrite.
This is along the same lines as "banner information disclosure", which is revealing version information via service banners. You should be able to configure your HTTPD to suppress this information. In an Apache production environment set
ServerTokens ProductOnly (thanks tftd). But this will just remove the version number, if you want to remove the word "apache" you have to use mod_security.
You could also lie >:). You can use mod_header to set any header, including a fake
x-powered-by, and just adopt .aspx file extensions using mod_rewrite.
You can achieve a little more of security through obscurity by also tweaking the following values:
php_flag display_startup_errors off php_flag display_errors off php_flag html_errors off php_value docref_root 0 php_value docref_ext 0
You can find some good advices here: