There is a bit of a debate here. Apache docs state ServerTokens should not be set to anything less than minimal(https://httpd.apache.org/docs/2.4/mod/core.html#

There is a bit of a debate here. Apache docs state ServerTokens should not be set to anything less than minimal(https://httpd.apache.org/docs/2.4/mod/core.html#servertokens https://httpd.apache.org/docs/2.4/mod/core.html#servertokens) which contradicts the OWasp recommendation (https://wiki.owasp.org/index.php/SCG_WS_Apache#Server_Token_Directive https://wiki.owasp.org/index.php/SCG_WS_Apache#Server_Token_...). From Apache docs: > Also note that disabling the Server: header does nothing at all to make your server more secure. The idea of "security through obscurity" is a myth and leads to a false sense of safety.