Comment on Disable Apache HTTP TRACE method to improve Apache security by Vikman.
Insertion of the rewrite rule in the .htaccess file worked for me. However, it only seemed to work for the http connection. The trace is still working on the https connection.
How to disable it for both?
I am using this site to test: http://web-sniffer.net/
Vikman Also Commented
Disable Apache HTTP TRACE method to improve Apache security
I don’t have access to the httpd.conf file. It’s a shared hosting setup so I can only modify .htaccess
I inserted this code into .htaccess:
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* – [F]
I then went to this site to test:
http://web-sniffer.net/
An http request gave the desired “405 Method Not Allowed” response. An https request did not.
So, I’m stumped. Is there some way in the .htaccess to explicitly spell out rewrite conditions for https requests? Is that what is needed?
