Where can I find the server tokens setting turned off in WordPress?

The "server tokens" setting, which reveals information about your web server software (like Apache or Nginx) and PHP version, is not a standard setting that you can toggle on or off directly within the WordPress admin dashboard. Instead, controlling server tokens typically involves configuring your web server or using specific plugins.

Here's a breakdown of where you can manage server tokens:

1. Web Server Configuration (Apache or Nginx):

- Apache: You can modify the Apache configuration file (usually `httpd.conf` or `apache2.conf`, or within virtual host files) to control server tokens. The directive you're looking for is `ServerTokens`. Setting it to `Prod` will hide most server information. For example:

ServerTokens Prod

- Nginx: In Nginx, you can control server tokens by modifying the `nginx.conf` file or the configuration file for your specific site. The directive is `server_tokens`. Setting it to `off` will hide the server version. For example:

server_tokens off;

- Note: After making changes to your server configuration, you'll need to restart your web server for the changes to take effect.

2. Using WordPress Plugins:

- Some security plugins for WordPress offer the ability to hide server tokens. These plugins often provide a user-friendly interface to manage various security settings, including server token visibility. Examples include:

- Wordfence Security: This plugin has a feature to hide server information in HTTP headers.

- iThemes Security (formerly Better WP Security): This plugin also provides options to remove server information.

- Note: Using a plugin is often easier for users who are not comfortable directly editing server configuration files.

3. .htaccess File (Apache):

- If you're using Apache, you can also add the `ServerTokens` directive to your `.htaccess` file. This method is less preferred than modifying the main server configuration, but it can be useful if you don't have access to the main configuration files. Add the following line to your `.htaccess` file:

ServerTokens Prod

- Note: Changes to the `.htaccess` file take effect immediately without needing to restart the server.

Why Turn Off Server Tokens?

Hiding server tokens is a security best practice. By not revealing your server software and PHP version, you make it slightly harder for potential attackers to identify vulnerabilities specific to your setup. This is a form of "security through obscurity," which, while not a complete security solution, is a useful layer of defense.

In summary, you won't find a direct setting in the WordPress admin panel to turn off server tokens. You'll need to either configure your web server directly or use a security plugin that provides this functionality.

Learn more about this