Server Configuration
Server Status Pages Access Check
Server status pages (Apache server-status, Nginx nginx_status) can reveal server information. Learn how to secure or disable them.
What this test checks
This test checks whether your server status pages (Apache /server-status, Nginx /nginx_status) are publicly accessible. These pages display detailed information about current requests, connections, processes, and sometimes visitor IP addresses. Their exposure can help an attacker understand your server architecture, detect weak points, or launch denial‑of‑service attacks.
Our recommendation
Protect access to status pages with authentication or IP restriction. In Apache, configure a location block with 'Require ip your-ip'. In Nginx, use 'allow' and 'deny' directives. If you don't use these pages, disable them completely in the server configuration. Regularly check their accessibility from outside.
Security tests
Read more
Form Security