By default, many web servers (like nginx) include their software name and exact version number in HTTP response headers and default error pages — information that’s genuinely useful to attackers and rarely useful to legitimate visitors.
Why it matters
Once an attacker knows your exact server software version, they can immediately check it against known vulnerabilities for that specific version — effectively handing them a head start on reconnaissance for free.
How to fix it (nginx example)
Set server_tokens off; in the nginx configuration, which removes the version number from the Server response header and default error pages. Equivalent settings exist for Apache (ServerTokens Prod) and other web servers.
FAQ
Does hiding version info alone make a server secure?
No — it’s "security through obscurity," a minor layer that slightly slows casual reconnaissance; it doesn’t substitute for actually patching the underlying software promptly.