Disable Trace or Track Method
If you have VPS or Dedicated server hosting, you may want to disable the TRACE or TRACK methods for the Apache web server. Disabling it is also required for PCI Compliancy if that's of interest to you. It's super easy to disable tracing for Apache if you're using a cPanel-based server.
Disable TRACE or TRACK Method
To disable TRACE or TRACK:
-
Log into your cPanel's hosting admin panel, Web Hosting Manager (WHM).
-
Click Service Configuration from the left-hand side navigation menu.
-
Click Apache Configuration.
-
Click Global Configuration.
-
In the Trace Enable section toggle or select the option Off.
-
Scroll down and click Save.
-
On the next page, click Rebuild Configuration and Restart Apache to restart the Apache Web Server.
Verify It's Disabled
After this is done you should verify that Apache TRACE method has in fact been disabled for your VPS or Dedicated server. To do this you can perform one of the two options below.
Perform an Internal Test from SSH Shell
telnet localhost 80
You should see that the system is waiting on a character. This proves that the connection cannot be made, which is what you want. Exit out of this by pressing CTRL + C on your keyboard.
Perform an External Test from a Remote Web Site
-
Go here: http://web-sniffer.net/.
-
Enter your domain name or IP address for your web server.
-
Enter the reCaptcha code and click Submit.
-
After the test finishes, you will see the following message in the HTTP Response Headers:
HTTP Status Code: HTTP/1.1 405 Method Not Allowed