Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is on Apache/2.2.21. In httpd.conf, I had the following directive:

<Location /server-status> 
    SetHandler server-status  
    Order deny,allow  
    Deny from all
    Allow from                                                                                             <Location> 

I realized recently that my own IP address no longer matched the "Allow from", but still I was able to access server-status! In other words, it was somehow set to be completely public. (I have now disabled it.)

How is this possible? The Location directive is global and my sites are served through vhosts.

Also, what is the best way to configure server-status when I am accessing it from a dynamically-assigned IP address?

share|improve this question
up vote 1 down vote accepted

Since this is outside of the <VirtualHost> definitions, I'm going to guess that you have Allow all directives inside of the <VirtualHost> blocks.

Sections inside <VirtualHost> sections are applied after the corresponding sections outside the virtual host definition. This allows virtual hosts to override the main server configuration.

See here.

share|improve this answer
Yes, thank you! There was another Location directive in the vhost and I did not realize that location "/" would trump the more specific location "/server-status". – vortek Jan 20 '12 at 17:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.