I did not wanted to say that disabling version information is a security measure. It is not. Sorry if I was not clear on that. I just wanted to say it may give

I did not wanted to say that disabling version information is a security measure. It is not. Sorry if I was not clear on that. I just wanted to say it may give you some time. That's debatable. You and others disagree. I remember an exploit for ProFTPd that required different payloads for different builds (OS, Version, Architecture). Having a database with version data und using that database would maximize the attackers chance to own the machine. Before checking the whole internet, why not at first try all machines where the exploit would work more likely. After that try all other machines. Another issue I remember was PLESK¹. They added some versions ago a Header "Powered-By Plesklin". There were a few PLESK exploits in the wild where an attacker with a database of versions and headers for services could quickly attack them. That is a reason for me to disable versions. It is totally unrelated to other security measures. I just don't want to give the attacker any additional clue. The more time he needs to spend probing my server the more time I have to notice him. I'm not sure how easy it is to order a botnet to execute an exploit for the whole internet. Other comments suggest it is no problem anymore. If that is indeed the case, it's probably really not relevant to disable versions or not. However I think I outlined my reasoning. 1: I know, don't use it. This was not up to me.