Web server detection

The server software that answered, as its own headers name it.

• Help center

The web server is the software that accepted the connection and sent back the response: nginx, Apache HTTP Server, LiteSpeed, Microsoft IIS, Caddy, or an edge network such as Cloudflare or Amazon CloudFront standing in front of the real machine.

How SiteScan identifies it

The row reads the Server response header of the entry page and maps it to a known product name, so Apache/2.4.62 (Debian) becomes "Apache HTTP Server 2.4.62". When the header is missing or has been rewritten, headers only one family sends serve as a fallback — cf-ray for Cloudflare, x-litespeed-cache for LiteSpeed, x-aspnet-version for IIS. A version is shown only when the server published one; nothing is guessed. If a CDN answers, its name is what you see, not the origin behind it.

The row is informational: green when a name was found, grey when the server keeps quiet.

Should you hide it?

The product name does little harm, but an exact version tells an attacker which known vulnerabilities to try. Keep the name if you like and drop the version: server_tokens off; in nginx, ServerTokens Prod with ServerSignature Off in Apache, and expose_php = Off against X-Powered-By. Then keep the software patched — hiding a version is no substitute for updating it. See version banner.