By Sudipta Dhara
Updated 2026-09-30
AI disclosure: drafted with AI assistance.
Who this is for: developers and devops engineers · Intermediate · You’ll need: an nginx you can read a Server header from, and the 404 body line on that same host
Short answer
On this host, the log date is 2026-09-30T00:01:38Z and nginx -v reported nginx version: nginx/1.31.3. The on setting printed HTTP/1.1 200 OK and HTTP/1.1 404 Not Found, both with Server: nginx/1.31.3. The 404 body line was <hr><center>nginx/1.31.3</center>. The off setting printed HTTP/1.1 200 OK and HTTP/1.1 404 Not Found, both with Server: nginx. The 404 body line was <hr><center>nginx</center>. Those lines are that run. They are not a header to copy onto another host.
server_tokens enables or disables emitting the nginx version on error pages and in the Server response header field. (nginx server_tokens) The documented default is server_tokens on. (nginx server_tokens) The value off disables that version. (nginx server_tokens) A build value and a custom string are different settings. (nginx server_tokens) A header you read on one host is not a promise that the next host uses the same value. Read the Server line from a run you did.
Who it’s for
This page is for a developer who already runs nginx and is about to set server_tokens off, or who is seeing a version in the Server header. The directive’s context is http, server, and location. (nginx server_tokens) The question underneath is whether this directive is enough before you pay for a separate gateway. This page does not price that product.
Not for
This page is not a commercial signature tutorial, a TLS hardening guide, or a hosting-stack story. It is not a keep-alive walkthrough, a body-size walkthrough, or a rate-limit walkthrough.
What the values do
The syntax is server_tokens on | off | build | string;. (nginx server_tokens) The documented default is server_tokens on;. (nginx server_tokens)
| Value | What the source says | When it matters |
|---|---|---|
on |
The documented default is server_tokens on;. Context is http, server, and location. The directive enables emitting the nginx version on error pages and in the Server response header field. (nginx server_tokens) |
You are reading the default. This run set on on one container. That header is this run. It is not proof that every host uses the default. |
off |
The syntax includes off. The directive disables emitting the nginx version on error pages and in the Server response header field. (nginx server_tokens) An empty string, not off, is the setting that disables emission of the Server field. (nginx server_tokens) |
You want the version gone and you still expect a Server header. |
build |
The build parameter (1.11.10) enables emitting a build name along with the nginx version. (nginx server_tokens) | You are reading a build name next to a version. This run did not set build. |
string |
As part of the commercial subscription, starting from version 1.9.13, the signature on error pages and the Server response header field value can be set explicitly using the string with variables. An empty string disables the emission of the Server field. (nginx server_tokens) |
You are on a build that has that commercial syntax, and you want a custom signature or no Server field. This run did not set a string. |
1.11.10 and 1.9.13 are version markers in that documentation. (nginx server_tokens) They are not this run’s nginx -v line.
Measurement
The log date is 2026-09-30T00:01:38Z. nginx -v reported nginx version: nginx/1.31.3.
Two throwaway nginx containers ran, then both containers were removed. One container was the on setting. One container was the off setting. This run did not set build. This run did not set a string.
| Setting | HTTP 200 | 200 Server |
HTTP 404 | 404 Server |
404 body line |
|---|---|---|---|---|---|
on |
HTTP/1.1 200 OK |
Server: nginx/1.31.3 |
HTTP/1.1 404 Not Found |
Server: nginx/1.31.3 |
<hr><center>nginx/1.31.3</center> |
off |
HTTP/1.1 200 OK |
Server: nginx |
HTTP/1.1 404 Not Found |
Server: nginx |
<hr><center>nginx</center> |
Both status lines for / were HTTP/1.1 200 OK, and both status lines for the missing path were HTTP/1.1 404 Not Found, so the comparison continued. The on container’s Server line was Server: nginx/1.31.3 on both statuses. The off container’s Server line was Server: nginx on both statuses. The header was present on the off container. This run does not show the field removed.
The 404 body line on the on container was <hr><center>nginx/1.31.3</center>. The 404 body line on the off container was <hr><center>nginx</center>. Those lines are this run. They are not a version string to copy onto another host.
The documented default server_tokens on is not the same claim as this run’s on container. (nginx server_tokens) The version nginx/1.31.3 is the nginx -v line from this run, and it is also the version text in this run’s on header and on 404 body line. It is not a version the documentation assigns to server_tokens.
The build parameter was not set. The build parameter (1.11.10) enables emitting a build name along with the nginx version. (nginx server_tokens) This page does not describe the on header as a build name.
A string was not set. An empty string disables the emission of the Server field. (nginx server_tokens) This run’s off container still sent Server: nginx.
Alternatives
Leave the documented default server_tokens on. (nginx server_tokens)
Set off and accept that the header may still exist without a version. The value off disables emitting the nginx version on error pages and in the Server response header field. (nginx server_tokens) This run’s off container sent Server: nginx and a 404 body line <hr><center>nginx</center>. Those lines are this run.
Set a string only where that commercial syntax exists. As part of the commercial subscription, starting from version 1.9.13, the signature on error pages and the Server response header field value can be set explicitly using the string with variables. (nginx server_tokens) An empty string disables the emission of the Server field. (nginx server_tokens) This run did not set a string. This page does not give a price for that subscription.
This page does not rank a gateway.
Cons
off is not a boundary by itself. The documented effect is enabling or disabling the nginx version on error pages and in the Server response header field. (nginx server_tokens) On this run, off left Server: nginx in place.
The documentation still allows a build value that adds a name next to the version. The build parameter (1.11.10) enables emitting a build name along with the nginx version. (nginx server_tokens) This run did not set build.
A custom string is not the off switch. The string form is part of the commercial subscription, starting from version 1.9.13. (nginx server_tokens) An empty string disables the emission of the Server field. (nginx server_tokens) off does not. This run’s off header was Server: nginx.
One host’s header is not every host.
What to check next
On the host that showed a version, read the Server line before you add a gateway. The directive enables or disables emitting the nginx version on error pages and in that header field. (nginx server_tokens) The documented default is server_tokens on. (nginx server_tokens)
Sources
Primary sources, each loaded and checked on 18 October 2026. The date in brackets is the check date for this revision.
- nginx
server_tokens: ngx_http_core_module server_tokens (checked 18 October 2026) - HTTP
Serverfield: RFC 9110 field.server (checked 18 October 2026) - MDN
Serverheader: MDN HTTP Headers Server (checked 18 October 2026)
