Disable unused Apache modules

The fix

# Debian / Ubuntu
sudo a2dismod status autoindex cgi cgid ldap authnz_ldap info userdir
sudo apachectl -t && sudo systemctl reload apache2

# RHEL / Rocky / Alma — comment the LoadModule lines
sudo vi /etc/httpd/conf.modules.d/00-base.conf

Audit first. The list above is a starting point, not a prescription.

Why it matters

A loaded module is code in the address space of a process that answers requests from the internet. It carries its vulnerabilities whether or not any of your vhosts use it.

The 2026 CVE list makes the point better than any argument:

CVE	Module	Effect
CVE-2026-23918	mod_http2	Double-free → RCE (CVSS 8.8), 2.4.66 only
CVE-2026-29167	mod_ldap	Dangling pointer in per-directory configs, 2.4.0–2.4.67
CVE-2026-49975	mod_http2	Memory exhaustion via crafted HTTP/2, 2.4.17–2.4.67
CVE-2026-24072	mod_rewrite	Privilege escalation via .htaccess expressions

mod_ldap is the instructive one. Almost nobody authenticates against LDAP from Apache — yet it is loaded by default on several distributions, and for eighteen months every version from 2.4.0 to 2.4.67 carried a dangling pointer in it. If you never used LDAP, that was a vulnerability you had for free, in exchange for nothing.

The ones worth turning off

mod_cgi / mod_cgid. This is the important one. CGI is what turns file disclosure into remote code execution — it is exactly how CVE-2021-41773 escalated from reading /etc/passwd to running commands. If you serve PHP through PHP-FPM (nearly everyone now) or run an application behind a reverse proxy, you do not need CGI.

mod_status. Publishes a live dashboard of every request in flight. It has its own page because it leaks so much.

mod_autoindex. Generates directory listings when there’s no index file. Disable the module and Options -Indexes becomes belt and braces rather than the only thing standing between a visitor and your file list.

mod_info. Serves your entire configuration at /server-info. There is no scenario where this belongs on a production server.

mod_userdir. Maps /~alice to /home/alice/public_html. If you’re not a 1998 university, turn it off — it also enumerates local usernames by response code.

mod_ldap / mod_authnz_ldap. Loaded by default in places, used almost nowhere.

What you can’t turn off

Be realistic about mod_http2: two of 2026’s CVEs are in it, and the answer is not to disable HTTP/2. It’s to patch. Wanting HTTP/2 means accepting mod_http2 as attack surface and keeping it current — which is why the pillar says patch first and everything else second.

Same for mod_rewrite: nearly every real site needs it. CVE-2026-24072 is only exploitable by someone who can write a .htaccess file, which is why AllowOverride None closes it independently of the module.

The rule isn’t “load less”. It’s “don’t load what you never call”.

Verify it worked

List what’s actually loaded:

sudo apachectl -M

That’s your real attack surface. Count it:

sudo apachectl -M 2>/dev/null | grep -c '_module'

A default Debian install loads far more than a typical site uses.

Check for the specific ones:

sudo apachectl -M 2>/dev/null | grep -E 'cgi|status|info|autoindex|userdir|ldap|proxy'

Then work out whether anything uses them before you cut. mod_rewrite is easy to check:

sudo grep -rlE 'RewriteEngine|RewriteRule' /etc/apache2/ /etc/httpd/ /var/www 2>/dev/null

And CGI:

sudo grep -rn 'ScriptAlias\|ExecCGI\|AddHandler cgi-script' /etc/apache2/ /etc/httpd/ 2>/dev/null
sudo find /var/www /usr/lib/cgi-bin -name '*.cgi' -o -name '*.pl' 2>/dev/null | head

No output from both means a2dismod cgi cgid is free.

After disabling, confirm it’s gone and the site still works:

sudo apachectl -M | grep -c cgi        # expect 0
curl -si http://localhost/ | head -1   # expect 200

Before you apply this

Disabling a module that something depends on takes the site down at reload, and Apache’s dependency errors are clearer than most — apachectl -t will refuse to start if a directive’s module is missing:

Invalid command 'RewriteEngine', perhaps misspelled or defined by a module not included

That’s the good case: you get it from -t before the reload, not from users. Always apachectl -t before reloading, and this page is the reason.

The modules with hidden dependencies:

• mod_authz_core, mod_authz_host, mod_mime, mod_dir — core plumbing. Require directives fail without the authz modules. Don’t touch these.
• mod_rewrite — disabling it breaks every RewriteRule, which for most PHP applications means every URL except the homepage 404s. Grep first.
• mod_proxy / mod_proxy_http — if Apache fronts an application server, these are load-bearing.
• mod_status — some monitoring scrapes /server-status. Disabling it silently blinds the monitor rather than erroring. Check what polls it before removing.

On Debian, a2dismod refuses when another enabled module depends on the one you’re removing, which is a genuine safety net. On RHEL you’re commenting LoadModule lines by hand and there is no such check — so apachectl -t is doing all the work, and skipping it is how you end up with a stopped web server.

Related

• Protect server-status — mod_status specifically.
• The Apache path traversal — why mod_cgi is the one that matters.