Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In the last few weeks I have been getting an increased HEAD traffic to my website of the form

HEAD / HTTP/1.0" 200 0 "-" "-"

This just returns the details of my web server, right?

The IPs are from all over the world. Any idea on why this started suddenly? I do get the usual attacks infrequently, but this HEAD traffic is roughly 2 per hour for the last 2 weeks.

Should I be worried? I find it hard to believe someone is trying to hack my website from Ouagadougou, Burkina Faso.

Has anyone else seen something similar recently?

share|improve this question
2  
You can test by sending the same headers to your web-server and observing what happens... –  NULLZ Dec 22 '13 at 5:17
    
Can you insert here some of request senders headers ? (UA , cookies and ... are needed). –  Sajjad Pourali Dec 22 '13 at 8:57
    
54.209.135.111 - - [22/Dec/2013:09:03:02 -0800] "HEAD / HTTP/1.0" 200 0 "-" "-" 203.88.197.120 - - [22/Dec/2013:09:41:11 -0800] "HEAD / HTTP/1.0" 200 0 "-" "-" 202.117.1.240 - - [22/Dec/2013:09:44:32 -0800] "HEAD / HTTP/1.0" 200 0 "-" "-" –  user35846 Dec 22 '13 at 19:33

1 Answer 1

No, you shouldn't be worried, especially not at the rate of HEAD HTTP requests that you're quoting. One such request every half an hour on average is really not much. Basically, HEAD requests do what it says on the box, that is, your web server will only return response headers and will not attach to it the complete response body. This can be useful to lower bandwidth requirements for simple tasks of e.g. establishing response code for requested location, client cache validation, and so on. That can then be used to either establish that your web server is responding, or if the requested location is still available, not re-send contents that weren't changed in the mean time and are already locally cached by the client,... depending on your server's response HTTP status code and header contents.

Now, these requests can be rather frequent and sometimes a bit annoying in quantity, but they're technically for your server better in terms of consuming its resources, since a well written web host can process such requests faster and consume less upload bandwidth to send back a response, than if it had to process and include in its response a complete document. With larger media files, this gets even more apparent. So I wouldn't advise to block such requests in your web server configuration, and if they make your server's log files less readable, I recommend you pipe such requests into a separate log file.

As far as what's returned in these headers, there's nothing much different in them that with the normal GET requests, with the exception that the content length will be obviously smaller. And there is no reason to think that increase in HEAD HTTP requests is some form of a DOS attack on your server, since it would take the same effort for the attacker to send GET requests, while at the same time exhaust your server's resources much faster. The only case when HEAD would do that faster than GET is if you don't rate limit or block by other means (e.g.request IP) the former, but you rate limit or filter the latter and a few other common HTTP request types like e.g. POST, which would be a case of misconfiguration and isn't really frequent. Do make sure you don't unwittingly disable any such filtering in your configuration for less common request methods tho, just to be sure.

So if you should block HEAD requests is up to you, but I wouldn't bother. There are other HTTP request types that are a lot more worrying, especially if you don't even have any use for them on your host, for example TRACE, SEARCH,OPTIONS,... And it is always a good practice to disable response to all HTTP request methods that your server software doesn't have any use for. For example, this is from my Apache config:

RewriteCond %{REQUEST_METHOD} ^(TRACE|SEARCH|TRACK|OPTIONS|PUT|QUIT|CONNECT|DELETE|PATCH|DEBUG|PROPFIND|PROPPATCH|MKCOL|COPY|MOVE|LOCK|UNLOCK) 
RewriteRule .* - [F]

This assures that none of the methods listed are served (request forwarded from the web server software to the application handling these requests and processing them) and the web server immediately denies them by returning a 403 Forbidden status code to the client. Do note though that your web applications might be written to require some of the HTTP methods that I block in my configuration, this example is not meant to be copied directly and can break functionality of your web host, if not used with caution!

share|improve this answer
    
Thanks for the detailed answer. I am not that worried about DOS the traffic is too light, but that it started suddenly, I have had the site for about 5 years. Could be for caching, would make sense as my site does not change much, so there are no followup requests. Or it could be someone using proxies from all over the world maybe to check for hackable webserver versions etc. –  user35846 Dec 22 '13 at 19:40
    
@user35846 Well, the fact that your example log entries use HTTP 1.0 protocol version could indicate we're talking of some rather old clients / libraries. Could be anything, from URL checker trying to establish if links in some remote database are still good, to robotic content scrapers. From your comment, 1st one is Amazon Web Services (AWS), 2nd one isn't blacklisted from China, 3rd one is blacklisted also from China, but as you can see, HEAD alone isn't a clear indication of their intent. And if you block it, they'll only try GET next anyway. –  TildalWave Dec 22 '13 at 20:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.