Disable Trace HTTP Request in Apache


By default, the HTTP TRACE request method is enabled in Apache web server.

Having this enabled can allow Cross Site Tracing attack and potentially give an option to a hacker to steal cookie information.


Disable the HTTP TRACE request method.

Edit your Apache configuration file/etc/apache2/httpd.conf and add the following:

# Disable the HTTP TRACE request method
TraceEnable off

Reload Apache

[root@nowherelan]# systemctl reload httpd.service

Use the online Request Method Security Scanner to remotely check your site for which HTTP request methods are allowed. It should list the TRACE method as “Method Not Allowed (405).”

My System Configuration

  • CentOS 7
  • Apache 2.4


Leave a Reply

Your email address will not be published. Required fields are marked *