| 1.2 Ensure the Server Is Not a Multi-Use System | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.1 Ensure Only Necessary Authentication and Authorization Modules Are Enabled - 'auth*' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | CONFIGURATION MANAGEMENT |
| 2.7 Ensure the User Directories Module Is Disabled | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | CONFIGURATION MANAGEMENT |
| 2.8 Ensure the Info Module Is Disabled | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 2.9 Ensure the Basic and Digest Authentication Modules are Disabled - auth_basic_module | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 2.9 Ensure the Basic and Digest Authentication Modules are Disabled - auth_digest_module | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 3.3 Ensure the Apache User Account Is Locked | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 3.7 Ensure the Core Dump Directory Is Secured | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | |
| 3.8 Ensure the Lock File Is Secured - 'LockFile directory' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 3.8 Ensure the Lock File Is Secured - 'LockFile permissions' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 3.9 Ensure the Pid File Is Secured | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 3.9 Secure the Pid File - 'PidFile directory' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 3.10 Ensure the ScoreBoard File Is Secured | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.11 Ensure Group Write Access for the Apache Directories and Files Is Properly Restricted | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 3.12 Ensure Group Write Access for the Document Root Directories and Files Is Properly Restricted | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 4.1 Ensure Access to OS Root Directory Is Denied By Default - 'httpd.conf Deny = from all | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 4.1 Ensure Access to OS Root Directory Is Denied By Default - 'httpd.conf no Allow directives exist' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 4.1 Ensure Access to OS Root Directory Is Denied By Default - 'httpd.conf no Deny directives exist' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 4.1 Ensure Access to OS Root Directory Is Denied By Default - 'httpd.conf no Require directives exist' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 4.1 Ensure Access to OS Root Directory Is Denied By Default - 'httpd.conf Order = Deny,Allow | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 4.1 Ensure Access to OS Root Directory Is Denied By Default - 'httpd.conf Require all denied | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 4.2 Ensure Appropriate Access to Web Content Is Allowed - 'httpd.conf Allow is configured' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 4.2 Ensure Appropriate Access to Web Content Is Allowed - 'httpd.conf Deny is configured' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 4.2 Ensure Appropriate Access to Web Content Is Allowed - 'httpd.conf Order Deny,Allow' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 4.2 Ensure Appropriate Access to Web Content Is Allowed - 'No Order/Deny/Allow' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 4.2 Ensure Appropriate Access to Web Content Is Allowed - 'Require is configured' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 5.4 Ensure Default HTML Content Is Removed - 'other handler does not exist' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | CONFIGURATION MANAGEMENT |
| 5.4 Ensure Default HTML Content Is Removed - 'Server Status handler does not exist' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | CONFIGURATION MANAGEMENT |
| 5.5 Ensure the Default CGI Content printenv Script Is Removed | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 5.6 Ensure the Default CGI Content test-cgi Script Is Removed | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 6.3 Ensure the Server Access Log Is Configured Correctly - 'httpd.conf CustomLog is configured' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3 Ensure the Server Access Log Is Configured Correctly - 'httpd.conf LogFormat is configured' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 6.4 Ensure Log Storage and Rotation Is Configured Correctly - '/etc/logrotate.conf rotate > 13' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 7.4 Ensure Weak SSL Protocols Are Disabled - 'SSLv2 or SSLv3' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.4 Ensure Weak SSL Protocols Are Disabled - 'TLSv1' | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 7.8 Ensure Medium Strength SSL/TLS Ciphers Are Disabled | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.2 Ensure KeepAlive Is Enabled | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 9.5 Ensure the Timeout Limits for Request Headers is Set to 40 or Less - RequestReadTimeout | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | CONFIGURATION MANAGEMENT |
| 18.11.2 Ensure 'Disable HTTP proxy features: Disable proxy authentication' is set to 'Enabled: Disable authentication over loopback interfaces' or higher | CIS Microsoft Windows Server 2022 v5.1.0 L1 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.11.2 Ensure 'Disable HTTP proxy features: Disable proxy authentication' is set to 'Enabled: Disable authentication over loopback interfaces' or higher | CIS Microsoft Windows Server 2025 v2.1.0 L1 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.11.2 Ensure 'Disable HTTP proxy features: Disable proxy authentication' is set to 'Enabled: Disable authentication over loopback interfaces' or higher | CIS Microsoft Windows Server 2025 Stand-alone v2.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.11.2 Ensure 'Disable HTTP proxy features: Disable proxy authentication' is set to 'Enabled: Disable authentication over loopback interfaces' or higher | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.11.2 Ensure 'Disable HTTP proxy features: Disable proxy authentication' is set to 'Enabled: Disable authentication over loopback interfaces' or higher | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.11.2 Ensure 'Disable HTTP proxy features: Disable proxy authentication' is set to 'Enabled: Disable authentication over loopback interfaces' or higher | CIS Microsoft Windows 11 Stand-alone v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 18.11.2 Ensure 'Disable HTTP proxy features: Disable proxy authentication' is set to 'Enabled: Disable authentication over loopback interfaces' or higher | CIS Microsoft Windows 11 Stand-alone v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.11.2 Ensure 'Disable HTTP proxy features: Disable proxy authentication' is set to 'Enabled: Disable authentication over loopback interfaces' or higher | CIS Microsoft Windows Server 2022 Stand-alone v2.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.11.2 Ensure 'Disable HTTP proxy features: Disable proxy authentication' is set to 'Enabled: Disable authentication over loopback interfaces' or higher | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| AS24-U1-000070 - The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events | DISA STIG Apache Server 2.4 Unix Server v3r2 Middleware | Unix | AUDIT AND ACCOUNTABILITY |
| AS24-U1-000070 - The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events. | DISA STIG Apache Server 2.4 Unix Server v3r2 | Unix | AUDIT AND ACCOUNTABILITY |
| WA000-WWA060 W22 - The HTTP request message body size must be limited. | DISA STIG Apache Server 2.2 Windows v1r13 | Windows | CONFIGURATION MANAGEMENT |
