0
Back to scan results
Check 4 of 44

Insecure Server Configuration

A focused review of common web-server configuration mistakes: accepted TRACE requests, overly specific software banners, and directory listings exposed to the internet. Check 42 separately performs the deeper WebDAV and HTTP-method review.

What this check probes

  • TRACE method — sends a TRACE request and reviews the response. Accepted TRACE requests require review; check 42 separately inspects advertised HTTP and WebDAV methods.
  • Server banner — inspects the Server response header. nginx alone is fine; nginx/1.18.0 (Ubuntu) is information leakage that helps an attacker target known CVEs.
  • X-Powered-By — same idea: X-Powered-By: PHP/7.2.10 tells an attacker exactly which CVEs to try.
  • Directory listing — requests known directory paths and looks for "Index of /" markup, which means autoindex is enabled and attackers can browse your filesystem.

Why this matters for PCI DSS

PCI DSS 4.0 Requirement 2.2 mandates that system components are configured securely and that all unnecessary services and functions are removed or disabled. Requirement 2.2.5 specifically calls out that "if any insecure services, protocols, or daemons are present" they must be justified, documented, and have additional security features enabled.

Remove unnecessary exposure, minimize implementation detail, and document any server behavior that must remain enabled for a legitimate business purpose.

How to fix it

Apache — in your main config:

TraceEnable Off
ServerTokens Prod
ServerSignature Off
<Directory /var/www/html>
    Options -Indexes
</Directory>

nginx — TRACE is not enabled by default. To strip the version from the banner:

http {
    server_tokens off;
    autoindex off;
}

IIS — disable TRACE and remove the Server header:

<system.webServer>
  <security>
    <requestFiltering>
      <verbs allowUnlisted="true">
        <add verb="TRACE" allowed="false" />
        <add verb="OPTIONS" allowed="true" />
      </verbs>
    </requestFiltering>
  </security>
  <security><requestFiltering removeServerHeader="true" /></security>
</system.webServer>

For X-Powered-By in PHP, edit php.ini: expose_php = Off. In ASP.NET, remove the header in web.config via <httpProtocol><customHeaders><remove name="X-Powered-By" />.

Verify TRACE handling with curl -i -X TRACE https://example.com/. Review check 42 for separate WebDAV and method-allowlisting guidance.

Fixed it? Re-run the scan to confirm.

Run scan again