> but I do not know how to remove the Server header completly with mod_security.

It is not possible to remove the Server header completely. ModSecurity
can only change it to something else. But I guess one could write an
output filter to remove it. In fact, I seem to recall someone
mentioning such output filter recently. Now if I could only remember
where...

Excerpt from a previous mail to this flamewar thread :
"
It seems that there is a lot of people who were requiring this feature.
I've developed a module ( http://modules.apache.org/search.php?id=962 ) that tricks the core of httpd by faking a proxy request in order to make it possible in module-land, to change this HTTP header.
"