prevent builtwith.com showing what my site is buil

问题:

Is there a way to mask my real server technology say from PHP to show up as Python when checked by sites like http://builtwith.com? Or at least to not show anything at all?

回答1:

Assuming you're using apache, you can change the default "tell all" behaviour with the ServerTokens and ServerSignature directives:

ServerTokens Prod
ServerSignature Off

This'll remove identifying marks from error pages, and only return the server name with HTTP requests, instead of all of your installed modules. Here's an example with ServerTokens commented out:

14:45:52 bartley:~ > curl -I http://www.test.com
HTTP/1.1 200 OK
Date: Mon, 16 May 2011 13:54:48 GMT
Server: Apache/2.2.15 (EL) DAV/2 PHP/5.2.16 mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_perl/2.0.4 Perl/v5.8.8
Accept-Ranges: bytes
Content-Length: 16457
Cache-Control: max-age=300, must-revalidate
Expires: Mon, 16 May 2011 13:59:48 GMT
Vary: Accept-Encoding,Cookie
Connection: close
Content-Type: text/html; charset=UTF-8

..and here's one with it set to Prod:

14:44:25 bartley:~ > curl -I http://www.test.com
HTTP/1.1 200 OK
Date: Mon, 16 May 2011 13:54:19 GMT
Server: Apache
Accept-Ranges: bytes
Content-Length: 16457
Cache-Control: max-age=300, must-revalidate
Expires: Mon, 16 May 2011 13:59:19 GMT
Vary: Accept-Encoding,Cookie
Connection: close
Content-Type: text/html; charset=UTF-8

EDIT: As @Marc points out, there is also a HTTP header that PHP can add an X-Powered-By header to. This can be disabled by adding expose_php = Off in your php.ini.

回答2:

I've seen this question asked with many other packages, the result is always that hiding what something is running, that's publicly accessible, is not really possible, and not worth the time - time's better spent tightening real security issues like keeping private directories private etc, correct set-up and keeping the software up to date

回答3:

The link provided by builtwith.com to remove your site from their lookup service is:

http://builtwith.com/removals

(Credit due to the person with user name "gary" who originally posted this link as a comment on the question; however, the link has since changed and it is better posted in an answer so it can be easily seen.)

回答4:

I think they test some path those are unique path for CMSs and index your website info in their databases. I try to use "IP Deny Manager" in Cpanel to denny IP of those domains in order to prevents from unwanted indexing by those sites.

回答5:

If you are using LiteSpeed, you can set the Server and X-Powered-By headers to anything you like, using either .htaccess or PHP.

.htaccess

Header always set X-Powered-By Something
Header always set Server Something

PHP

header('X-Powered-By: Something');
header('Server: Something');