I have a default Apache installation on Ubuntu 10.04.
I use the following Nmap scan to determine the available Apache methods:
nmap -p80 --script=http-methods 192.168.1.66
The result is:
http-methods: GET HEAD POST OPTIONS
I'm trying to eliminate the HEAD method. So in
/etc/apache2/apache.conf I added the following:
<Directory "/var/www/*"> <LimitExcept GET POST OPTIONS> Deny from all </LimitExcept> ... </Directory>
I then restarted the web server. However the nmap scan still prints the same results.
Does anyone know what I'm missing here?