5.2 Ensure Options for the Web Root Directory Are Restricted

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


The Apache Options directive allows for specific configuration of options, including:

Execution of CGI

Following symbolic links

Server side includes

Content negotiation


The Options directive at the web root or document root level also needs to be restricted to the minimal options required. A setting of None is highly recommended, however it is recognized that this level content negotiation may be needed if multiple languages are supported. No other options should be enabled.


Perform the following to implement the recommended state:

Search the Apache configuration files (httpd.conf and any included configuration files) to find the document root <Directory> element.

Add or modify any existing Options directive to have a value of None or Multiviews, if multiviews are needed.

<Directory '/usr/local/apache2/htdocs'>
. . .
Options None
. . .

Default Value:

The default value for the web root directory's Option directive is FollowSymLinks.

See Also