Windows系统下Apache的httpd.conf定位及HTTP头信息泄露漏洞修复

Alright, let's walk through solving this—first tracking down that missing httpd.conf file on your Windows 10 Apache production server, then patching the HTTP header info leak vulnerability.

Here are three reliable methods to find your configuration file:

• Check default installation directories
  If you installed Apache manually, the config is usually in:

  • C:\Program Files\Apache Group\Apache2\conf (older versions)
  • C:\Apache24\conf (Apache 2.4+ default)
    For XAMPP/WAMP stacks:
  • XAMPP: C:\xampp\apache\conf\httpd.conf
  • WAMP: C:\wamp64\bin\apache\apache[your-version]\conf\httpd.conf (replace [your-version] with your actual Apache version like 2.4.54)

• Use Apache's command-line tool
  Open Command Prompt (CMD), navigate to Apache's bin directory (e.g., cd C:\Apache24\bin), then run:

  httpd -V
  

  Look for the SERVER_CONFIG_FILE line in the output—it will show the relative or absolute path to httpd.conf, like:

  -D SERVER_CONFIG_FILE="conf/httpd.conf"
  Combine this with your Apache root directory to get the full absolute path.

• Check Apache service properties

  1. Press Win+R, type services.msc and hit Enter to open the Services Manager
  2. Find your Apache service (typically named Apache2.4 or matching your version)
  3. Right-click → Properties → Look at the "Path to executable" field—it will include the full path to httpd.conf in the startup arguments, e.g.:

     "C:\Apache24\bin\httpd.exe" -k runservice -f "C:\Apache24\conf\httpd.conf"
     

Once you've found httpd.conf, follow these steps to secure your server headers:

1. Open httpd.conf with Administrator privileges
   You need admin rights to save changes—right-click your text editor (Notepad, VS Code, etc.) and select Run as administrator, then open the config file.

2. Hide Apache version details
   Locate the ServerTokens directive and set its value to Prod:

   ServerTokens Prod
   

   This tells Apache to only return Server: Apache in headers, instead of exposing version numbers, module details, or OS info.

3. Disable server signatures on error pages
   Find the ServerSignature directive and set it to Off:

   ServerSignature Off
   

   This removes the server version and hostname that normally appears at the bottom of Apache error pages.

4. Optional: Fully customize the Server header
   If you want to replace the Server header entirely (not just hide details), use Apache's mod_headers module:

   • First, enable the module by removing the # comment from this line:

     #LoadModule headers_module modules/mod_headers.so
     

     Change it to:

     LoadModule headers_module modules/mod_headers.so
     

   • Add this line at the end of httpd.conf to set a custom Server header:

     Header always set Server "Web Server"
     

   Now your server will return Server: Web Server instead of any Apache-specific info.

5. Restart Apache to apply changes

   • Open Services Manager, find your Apache service, right-click → Restart
   • Or use CMD (as admin):

     net stop Apache2.4
     net start Apache2.4
     

     (Replace Apache2.4 with your actual service name)

6. Verify the fix
   Test using curl (if installed):

   curl -I http://your-server-ip-or-domain
   

   Or use your browser's DevTools (F12 → Network tab → inspect the response headers) to confirm the Server header no longer exposes sensitive version or tech details.

内容的提问来源于stack exchange，提问作者Ganesh Kumar