Server

Identifies software used by the origin server that generated a response.

Use a minimal or generic Server value, or omit it when possible, to reduce passive technology disclosure. It is not a complete fingerprinting defense.

httpheadersecurityprivacy

Reference (http)

Server: webserver

Use a minimal or generic Server value, or omit it when possible, to reduce passive technology disclosure. It is not a complete fingerprinting defense.

Common mistakes

Assuming hiding Server prevents active technology fingerprinting.

IANA registry: http-fields/field-names

Registry reference: RFC 9110, Section 10.2.4: HTTP Semantics

Sources

MDN HTTP Reference
OWASP HTTP Headers Cheat Sheet
IANA HTTP Field Name Registry