First enable the mod_headers module:

   1  sudo a2enmod headers

Then add this to your apache2.conf:

   1  # Hide X-Powered-By and Server headers
   2  Header always unset "X-Powered-By"
   3  ServerTokens Prod
   4  ServerSignature Off

Now restart Apache:

   1  /etc/init.d/apache2 force-reload

This is security through obscurity at it’s finest…