mediumSeverity: mediumRisk ratingHow usable this gap is to an attacker. Severity sets the posture penalty: critical −40, high −20, medium −10, low −4, info −1. Higher severity means fix it sooner.Web server configWhere it livesImplementationThis fix is applied in: Web server config. That's the surface you'll edit, DNS, response headers, or a static file.~5 minTime to fixEffortRoughly 5 minutes of hands-on work, propagation aside. Most of these are copy-paste.+10 posture+10 postureScore impactPoints this fix recovers in the ApeCyber posture score (0–100). Posture = 100 minus the severity penalty of every open finding; clearing this finding adds these points back.

Exposed server-status: take Apache's live traffic view off the public web

Restricting mod_status to localhost stops the public watching your live requests and visitor IPs.

The threat

The scanner loaded /server-status and got Apache’s live status page. That page is produced by mod_status, and it is genuinely useful for an operator looking at their own server. The trouble is that this copy is open to the whole internet.

With ExtendedStatus on, the page shows what is happening right now: every in-flight request’s URL (query strings included), the client IP making it, the vhost and method, worker state, plus uptime and traffic totals. Anyone loading the page can effectively watch your visitors’ IP addresses and the exact pages they are requesting in real time, which is both a privacy problem for your users and free live reconnaissance for an attacker.

The exact fix

Keep the page for yourself, off the public internet. Restrict it to the local machine.

Restrict mod_status to localhost in your Apache config, replacing any Require all granted or old Allow from all:

<Location "/server-status">
    SetHandler server-status
    Require local
</Location>

Require local allows only 127.0.0.1 and ::1, so the page still works over an SSH tunnel or from the box itself, but returns 403 to everyone else.

If you do not use it, turn the module off entirely:

# Debian / Ubuntu
sudo a2dismod status
sudo systemctl reload apache2

Lock down /server-info the same way, since mod_info exposes your full module and config layout and tends to be enabled alongside status.

Behind a proxy or load balancer? Require local then sees the proxy’s IP, not the visitor’s, so the rule can pass the wrong traffic. Also block /server-status at the edge (CDN, reverse proxy, or firewall) so it never reaches Apache from outside.

Verify it

curl -s -o /dev/null -w '%{http_code}\n' https://yourdomain.com/server-status

Run it from a machine that is not the server. You want 403 (restricted) or 404 (module off), never a 200 that returns a page titled Apache Server Status.

Proof

The ApeCyber scanner confirms this with a single GET of /server-status from the outside, touching nothing. apecyber.com runs on Netlify’s CDN rather than Apache, so there is no mod_status page to expose, and it grades A / 100. Restricting it is a clean −10 off the posture score.