Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a default Apache installation on Ubuntu 10.04.

I use the following Nmap scan to determine the available Apache methods:

nmap -p80 --script=http-methods

The result is:


I'm trying to eliminate the HEAD method. So in /etc/apache2/apache.conf I added the following:

<Directory "/var/www/*">
Deny from all

I then restarted the web server. However the nmap scan still prints the same results.

Does anyone know what I'm missing here?

share|improve this question

migrated from Jul 18 '11 at 15:55

This question came from our site for computer enthusiasts and power users.

I think Get and Head must be treated similarly, as Head is essentially a Get with no content returned (To check for updates). so, I think there is some dependency between the two - that must be accounted for in configuration. – slotishtype Jul 18 '11 at 13:43
Why do you want to remove HEAD? What benefit do you think you will gain from this? – Zoredache Jul 18 '11 at 17:46
I don't use it, so I want to disable it. – lisa1987 Jul 18 '11 at 18:39
@brahims - you might not use it, but your browser uses it all the time. The only time you should disable it is if you have 100% control over every client application that is going to access it (for example, it's a web service that's used exclusively by your own software), but there's no security risk in head, so it's a bit of a misnomer anyway. – Mark Henderson Jul 20 '11 at 2:14
up vote 3 down vote accepted

The documentation for <Limit> explicitly states:

If GET is used it will also restrict HEAD requests

This very strongly implies that for the purposes of <Limit> and <LimitExcept> that GET and HEAD are treated the same. Restrictions applied to GET will apply to HEAD, and therefore if GET is unrestricted so HEAD will also be unrestricted.

Further, the HTTP/1.1 RFC 2616 explicitly states (section 9.4):

The HEAD method is identical to GET except that the server MUST NOT return
a message-body in the response.

Further clarifying the direct relationship between GET and HEAD.

The final piece of information to clarify this, also from RFC 2616, (section 5.1.1):

The methods GET and HEAD MUST be supported by all general-purpose servers.

This information all together tends to strongly imply that what you wish to accomplish will not be possible by configuration changes alone.

share|improve this answer
OK. I've tried with <LimitExcept GET HEAD> and still same nmap output :) Do you think it is possible to configure any of these 4 methods (GET HEAD POST OPTIONS) by configuration changes? – brahims Jul 18 '11 at 15:35
Try moving your <Limit> directive out of the <Directory> specification and into your <VirtualHost *:80> definition instead... – Mike Insch Jul 18 '11 at 15:46
I've tried that as well.. I guess I'm just out of luck :/ Thanks for the answers anyway Mike – lisa1987 Jul 18 '11 at 16:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.