Apache HTTP Server

A `Server` header beginning with `Apache` — weight 85.

When the header includes a version, such as `Apache/2.4.58`, it is extracted and listed exactly as published.

Apache frequently sits behind a CDN or proxy; the header identifies whatever answered the request.

Modules named in the header, such as a PHP version, are reported by their own rules when they match.

The core documentation gives `ServerTokens Full` as the default, and describes Full, or no setting, as sending the version, the operating system and module information — its example is `Server: Apache/2.4.2 (Unix) PHP/4.2.2 MyMod/1.2`.

`ServerTokens Prod` sends only `Apache`. The documentation adds that the setting applies to the whole server rather than per virtual host, and that hiding the header does nothing on its own to make a server more secure.

`ServerSignature`, which adds a footer line to server-generated pages such as error pages and listings, defaults to `Off`.

A header naming modules and their versions is a larger disclosure than a bare product name, and a two-word configuration change removes most of it.

`Options` defaults to `FollowSymlinks` in the core documentation, which does not include `Indexes`.

A listing therefore means `Options Indexes` was enabled for that directory, in the main configuration or in a `.htaccess` file.

mod_autoindex then generates the listing when no index file is present.

Because `.htaccess` files can enable it per directory, a listing can appear in one folder of an otherwise clean site.

`.htaccess` files let directory-level configuration override the main configuration where `AllowOverride` permits.

They are how many shared hosts and CMS installations configure redirects, headers and access rules.

The documentation's own guidance is to put configuration in the main server file when you have access to it, because directives there are loaded once at start rather than on every request.

An audit sees their effects in responses — redirects, headers, listings — never the files themselves.

`technology.inventory` and `technology.versions` list Apache and any version published.

`security.server_disclosure` reports the version and module strings in the header.

`wordpress.directory_listing` reports listings on WordPress sites; the listing problem page covers them in general.

`infrastructure.reverse_proxy` reports proxy signatures that show whether Apache is the component answering.

mod_headers applies each directive to one of two internal tables: `onsuccess`, the default, or `always`.

The documentation advises specifying `always` for a header that must be included in non-2xx responses such as redirects or errors, and warns that the difference is unintuitive and a frequent source of confusion.

A security header configured without `always` can therefore be missing from exactly the redirects that should carry it — the HTTP-to-HTTPS redirect included.

Checking the headers of a redirect and of an error page, not only of a normal page, is how to find it.