Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Apache 2.4 webserver running on Windows. I am looking into system hardening and the config file httpd.conf. There are numerous load modules and I am wondering which modules I can safely disable for performance and / or security improvements.

Some examples of things I would think I can disable are:

LoadModule cgi_module
others like 
LoadModule rewrite_module
LoadModule version_module
LoadModule proxy_module
LoadModule setenvif_module 

I am not so sure they can be disabled.

I am running php5 as a scripting engine, with no databases, and that is it. My loaded modules are:

core mod_win32 mpm_winnt http_core mod_so mod_access_compat mod_actions mod_alias mod_allowmethods mod_asis mod_auth_basic mod_authn_core mod_authn_file mod_authz_core mod_authz_groupfile mod_authz_host mod_authz_user mod_autoindex mod_dav_lock mod_dir mod_env mod_headers mod_include mod_info mod_isapi mod_log_config mod_cache_disk mod_mime mod_negotiation mod_proxy mod_proxy_ajp mod_rewrite mod_setenvif mod_socache_shmcb mod_ssl mod_status mod_version mod_php5

share|improve this question

migrated from superuser.com May 28 at 21:24

This question came from our site for computer enthusiasts and power users.

    
Just go down the list. You are the best judge to know if a module should be enabled or disabled. We know nothing about your website implementation or what features it requires. –  Ramhound May 25 at 18:08
    
httpd.apache.org/docs/2.4/mod I wish there was greater detail in the descriptions. –  j0h May 26 at 1:09
    
You won't be able to disable the core modules. Everything else can be disabled if you want it. That is all the help I can provide. –  Ramhound May 26 at 10:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.