Editing Apache HTTP Server (section)

==Security==
{{Disputed section|date=January 2021}}
Apache, like other server software, can be hacked and exploited. The main Apache attack tool is [[Slowloris (computer security)|Slowloris]], which exploits a bug in Apache software.<ref>{{cite web|url=https://isc.sans.edu/diary/Apache+HTTP+DoS+tool+mitigation/6613|title=Apache HTTP DoS tool mitigation|last=Zdrnja|first=Bojan|publisher=[[SANS Institute]]|date=21 June 2009|access-date=12 November 2021|archive-date=12 November 2021|archive-url=https://web.archive.org/web/20211112130802/https://isc.sans.edu/diary/Apache+HTTP+DoS+tool+mitigation/6613|url-status=live}}</ref> It creates many sockets and keeps each of them alive and busy by sending several bytes (known as "keep-alive headers") to let the server know that the computer is still connected and not experiencing network problems. The Apache developers have addressed Slowloris with several modules to limit the damage caused; the Apache modules mod_limitipconn, [[mod_qos]], mod_evasive, [[mod security]], mod_noloris, and mod_antiloris have all been suggested as means of reducing the likelihood of a successful Slowloris attack.<ref name="ha.ckers.org">{{cite web |url=http://ha.ckers.org/slowloris |title=Slowloris HTTP DoS |access-date=2009-06-26 |url-status=bot: unknown |archive-url=https://web.archive.org/web/20150426090206/http://ha.ckers.org/slowloris |archive-date=26 April 2015 |df=dmy-all }}</ref><ref>{{cite web |url=http://bahumbug.wordpress.com/2009/07/01/mod_noloris-defending-against-dos/ |title=mod_noloris: defending against DoS |date=July 2009 |publisher=niq's soapbox |access-date=7 January 2012 |archive-date=8 October 2011 |archive-url=https://web.archive.org/web/20111008151654/http://bahumbug.wordpress.com/2009/07/01/mod_noloris-defending-against-dos/ |url-status=live }}</ref> Since Apache 2.2.15, Apache ships the module mod_reqtimeout as the official solution supported by the developers.<ref>{{cite web |url=https://httpd.apache.org/docs/2.4/mod/mod_reqtimeout.html |title=mod_reqtimeout |publisher=Apache.org |access-date=2013-07-03 |archive-date=2013-07-03 |archive-url=https://web.archive.org/web/20130703041319/http://httpd.apache.org/docs/2.4/mod/mod_reqtimeout.html |url-status=live }}</ref>