STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to APACHE 2.2 Server for Windows Security Technical Implementation Guide

V-26368

CAT II (Medium)

Automatic directory indexing must be disabled.

Rule ID

SV-33225r1_rule

STIG

APACHE 2.2 Server for Windows Security Technical Implementation Guide

Version

V1R13

CCIs

None

Discussion

To identify the type of web servers and versions software installed it is common for attackers to scan for icons or special content specific to the server type and version. A simple request like http://example.com/icons/apache_pb2.png may tell the attacker that the server is Apache 2.2 as shown below. The many icons are used primary for auto indexing, which is recommended to be disabled.

Check Content

Open a command prompt window.

Navigate to the “bin” directory (in many cases this may be [Drive Letter]:\[directory path]\Apache Software Foundation\Apache2.2\bin>).

Enter the following command and press Enter: httpd –M

This will provide a list of all loaded modules. If the following module is found this is a finding: autoindex_module.

Fix Text

Disable the autoindex_module by adding a "#" in front of it within the httpd.conf file, and restarting the Apache httpd service.