SEC-026
Apache server-status page is public
MediumDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
/server-status and /server-info.
Why it matters
Shows every URL being requested right now (including tokens in query strings) and the server’s modules and configuration.
Recommended fix
Restrict mod_status and mod_info to localhost or remove them.
How to verify
Request each listed path on the live site and confirm it returns 404 or 403.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-026: Apache server-status page is public
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Restrict Apache mod_status / mod_info so /server-status and /server-info are only reachable from localhost (Require local), or disable the modules.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path on the live site and confirm it returns 404 or 403.