STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

APACHE 2.2 Site for UNIX Security Technical Implementation Guide

Version

V1R11

Benchmark ID

APACHE_SITE_2.2_UNIX

Total Checks

29

Tags

web
CAT I: 4CAT II: 21CAT III: 4

All directives specified in this STIG must be specifically set (i.e. the server is not allowed to revert to programmed defaults for these directives). Included files should be reviewed if they are used. Procedures for reviewing included files are included in the overview document. The use of .htaccess files are not authorized for use according to the STIG. However, if they are used, there are procedures for reviewing them in the overview document. The Web Policy STIG should be used in addition to the Apache Site and Server STIGs in order to do a comprehensive web server review.

Export CKLExport CSVExport JSON

Checks (29)

V-13686HIGHWeb Administrators must only use encrypted connections for Document Root directory uploads.V-13687MEDIUMRemote authors or content providers must have all files scanned for viruses and malicious code before uploading files to the Document Root directory.V-13688MEDIUMLog file data must contain required data elements.V-13689MEDIUMAccess to the web server log files must be restricted to administrators, web administrators, and auditors.V-13694MEDIUMPublic web servers must use TLS if authentication is required.V-15334LOWWeb sites must utilize ports, protocols, and services according to PPSM guidelines.V-2226MEDIUMWeb content directories must not be anonymously shared.V-2227HIGHSymbolic links must not be used in the web content directory tree.V-2228MEDIUMAll interactive programs (CGI) must be placed in a designated directory with appropriate permissions.V-2240MEDIUMThe number of allowed simultaneous requests must be set.V-2245LOWEach readable web document directory must contain either a default, home, index, or equivalent file.V-2249HIGHWeb server administration must be performed over a secure path or at the local console.V-2250MEDIUMLogs of web server access and errors must be established and maintainedV-2252MEDIUMLog file access must be restricted to System Administrators, Web Administrators or Auditors.V-2254MEDIUMOnly web sites that have been fully reviewed and tested must exist on a production web server.V-2258HIGHWeb client access to the content directories must be restricted to read and execute.V-2260MEDIUMA web site must not contain a robots.txt file.V-2262MEDIUMA private web server must utilize an approved TLS version.V-2263MEDIUMA private web server will have a valid DoD server certificate.V-2265LOWJava software on production web servers must be limited to class files and the JAVA virtual machine.V-2270MEDIUMAnonymous FTP user access to interactive scripts is prohibited.V-2272MEDIUMPERL scripts must use the TAINT option.V-26279MEDIUMError logging must be enabled.V-26280MEDIUMThe sites error logs must log the correct format.V-26281MEDIUMSystem logging must be enabled.V-26282MEDIUMThe LogLevel directive must be enabled.V-3333MEDIUMThe web document (home) directory must be in a separate partition from the web server’s system files.V-6373LOWThe required DoD banner page must be displayed to authenticated users accessing a DoD private website.V-6531MEDIUMPrivate web servers must require certificates issued from a DoD-authorized Certificate Authority.