Question: We had feedback from our pentest report saying we should turn off server tokens. This is stop people being able to see which version of PHP we are using, and limit their ability to target the specific PHP version.

I have added the following to nginx.conf, under the http block:

```
server_tokens off;

```

But what tools can I use to check this change has taken affect?

Answer: 
After a bit more googling, I have found curl command can check the server headers which shows both server tokens and php versions:

```
curl -I -L www.example.com

```

Thanks to Alexey for pointing out the change needed in PHP.

```
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Thu, 04 Jun 2015 10:49:35 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://www.example.com

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 04 Jun 2015 10:49:36 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Last-Modified: Thu, 04 Jun 2015 10:49:35 GMT
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0
ETag: "1433414975"
Content-Language: en

```
Also, if you serve PHP projects, you may need to change in `/etc/nginx/{fastcgi,fastcgi_params).conf` 

```
fastcgi_param  SERVER_SOFTWARE    nginx;

```