• Hello, I am totally new here, i hope I didn’t hit wrong forum. I hope I can get help.

    I don’t like that my website show server information (for example to hackers) and when I type any wrong URL like img folder I get error page “the requested url was not found on this server”. but the problem is that wordpress error page show information about my server: Apache/2.4.62 (Debian) Server at mydomain.com Port 443

    I would like to say that I changed parameters in server to stop leaking information about server, so, it must be problem with wordpress and not with apache and php.

    apache configuration file:

    ServerTokens Prod
    ServerSignature Off

    PHP.INI file:

    expose_php = off
Viewing 4 replies - 1 through 4 (of 4 total)
  • I would like to say that I changed parameters in server to stop leaking information about server, so, it must be problem with wordpress and not with apache and php.

    No, that conclusion is wrong.

    It’s your server “leaking” the information, not WordPress.

    In fact, if you’re seeing this info on the “Not Found” page itself (not in the HTTP response header), then even this “Not Found” error page is not from WordPress but coming directly from your server.

    You’re knocking on the wrong door, unfortunately.

    Moderator threadi

    (@threadi)

    WordPress does not affect these HTTP headers at any point. However, it is possible that a plugin you are using does this. You would have to deactivate all plugins to test this.

    My other question would be whether you also restarted the Apache service after the change?

    And if you change the php.ini, you must of course also find and adjust the one that is actually used by your server service. I think you can also see this in the WordPress backend under Tools > Website status.

    Thread Starter anarhista

    (@anarhista)

    Thank you for answer, I restarted appache it is not problem, I modified all php.ini files not only one, in php folder, I dont have status page in tools but I have site health and there is everything okay, website passed all checks and about php too but it is not written anything about INI file and exposure of server. I will try to disable all plugins after dinner, one person should send me message from contact form, I must wait to disable plugins, when I do it I will see if problem is solved. if it is not solved, I will visit debian or linux forum to ask there for help because you say it is not problem produced by wordpress. you can mark this topic as solved if you want although still I didn’t find solution. have a nice day and thank you for answers.

    Thread Starter anarhista

    (@anarhista)

    I got answer at linux server forum, just to publish here if someone get the same problem.

    i followed tutorial at digitalocean and now error page doesn’t show info about server (although I didn’t succeed to make nice error page but error forward to home page and everything is nice).

    I creaated 404error.html page and uploaded it to wordpress root folder, I included also just one line in htaccess file:

    ErrorDocument 404 /404error.html

    that was enough to solve the problem, but I will have to repeat it for 6 websites. although I wanted that error page show picture and visitor should click on picture to go to home page, I included picture img src and ahref to forward to home page in html file, but error page doesnt show picture but it forwards to home page when you type non existent folder in url, for example IMG, when I try to go to wp-content and plugin url, it shows blank white page, because it is not error page, it is not forwarding to home page, it is just blank. but it doesn’t leak server information and that’s the most important.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘how to stop WP leaking server information?’ is closed to new replies.