Question: We had feedback from our pentest report saying we should turn off server tokens. This is stop people being able to see which version of PHP we are using, and limit their ability to target the specific PHP version.

I have added the following to nginx.conf, under the http block:

```
server_tokens off;

```

But what tools can I use to check this change has taken affect?

Answer: 
From the [manual](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens) you know what the setting does:

> 
> **Syntax**: `server_tokens on | off`;  
> 
> **Default**: `server_tokens on`;  
> 
> **Context**: http, server, location 
> 
> 
> *Enables or disables emitting nginx version in error messages and in the “Server” response header field.*
> 
> 
> 

So your options are:

* generate an error message, for instance if you don't have a custom 404 error message simply request a non-existing page and in the footer you won't see the version information `nginx/1.2.3` any more.
* inspect the server headers and confirm that the version is no longer displayed.

A simple check to see the HTTP response headers is to manually connect i.e. with: `telnet www.example.com 80` where the client lines are what you enter:

> 
> client: HEAD / HTTP/1.1  
> 
>  client: Host: www.example.com 
> 
> 
> server: HTTP/1.1 200 OK  
> 
>  server: Date: Wed, 1 Jan 1970 22:13:05 GMT  
> 
>  server: **Server: Nginx/1.2.3**  
> 
>  server: Connection: close  
> 
>  server: Content-Type: text/html 
> 
> 
>
Also, if you serve PHP projects, you may need to change in `/etc/nginx/{fastcgi,fastcgi_params).conf` 

```
fastcgi_param  SERVER_SOFTWARE    nginx;

```