WA00500 W22 - Active software modules must be minimized.


Modules are the source of Apache httpd servers core and dynamic capabilities. Thus not every module available is needed for operation. Most installations only need a small subset of the modules available. By minimizing the enabled modules to only those that are required, we reduce the number of doors and have therefore reduced the attack surface of the web site. Likewise having fewer modules means less software that could have vulnerabilities.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.


Disable any modules that are not needed by adding a '#' in front of them within the httpd.conf file, and restarting the Apache httpd service.

See Also


Item Details


References: 800-53|CM-7a., CAT|II, Rule-ID|SV-33167r1_rule, STIG-ID|WA00500_W22, Vuln-ID|V-26285

Plugin: Windows

Control ID: ef9234a8b17a2619c90ccf281c3bd8974fb5808a62190b2f0196de24e067a8ed