Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have seen increased 'HEAD' requests in my webserver access.log. What are these requests for? Should I disable this method in my webserver configs?

share|improve this question
3  
In any case, some web servers like Apache don't allow you to disable HEAD request without disabling GET. –  Question Overflow Jul 10 at 9:16
    
Please read my comment on the very similar topic: security.stackexchange.com/a/56976/32976 –  boleslaw.smialy Jul 10 at 9:24

2 Answers 2

up vote 31 down vote accepted

No.

Relevant quote from the link:

HEAD

Asks for the response identical to the one that would correspond to a GET request, but without the response body. This is useful for retrieving meta-information written in response headers, without having to transport the entire content.

If you disabled it, you'd just increase your throughput cost. A person can get the same information with a GET, so if they were trying to do something malicious, they could just use a GET. Except, this way, they're being nice and not forcing you to send the request body.

EDIT: I don't know what the requests would be from, although I can certainly think of uses. Anyone else who knows or wants to chip in, please do so. I'm kinda curious, myself. Hence, community wiki.

share|improve this answer
    
reqests are for random directory names and come from "DirBuster-0.12 (owasp.org/index.php/Category:OWASP_DirBuster_Project)"; So I guess some reconnaissance is going on –  hnn Jul 9 at 19:28
    
Hmm... You could blacklist their IP. Or just heavily log and watch traffic from that IP without letting them know you're doing it; maybe with a transparent proxy. Watch for any change (because if there is any change... Or you could just contact their ISP. If they have a domain (which you can use dig -x to discover, or just normal dig with .in-addr.arpa and a reversed address), I'd ask them directly first, then contact their ISP. –  Parthian Shot Jul 9 at 19:48
2  
Good answer! HEAD requests are commonly used by proxies or CDN's to efficiently determine whether a page has changed without downloading the entire body. (esp large media files) –  Barett Jul 10 at 1:00
1  
Someone is probably running wget -m http://yoursite as a cron job. If you disable HEAD, you'll have no fun. –  Damon Jul 10 at 10:40

Everything Parthian said was spot on. HEAD requests are a like a 'short' GET request that avoids the network extra traffic and potentially the rendering overhead of a GET request.

There are a variety of reasons you, your browser, or your search engine may want to do a HEAD request. Some websites may just be pulling meta information off you, and your smaller response is to your benefit. More likely your browser or search engines are probably using HEAD requests to see if their cached versions of your pages are still up to date.

The Response header's "date" and "expires" field should be used by clients when your page is cached to determine when the next time they should visit your site for an update. Also the response headers may sometimes include a modified date that could also be used to indicate when your page needs to be updated.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.