According to Guide to the Secure Configuration of Red Hat Enterprise Linux 6, there is this policy:

"In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality of the HTTP Server. To do so, simply comment out the entire line which loads the module you wish to remove in the /etc/httpd/conf/httpd.conf file".*

How should I know which modules are needed for some web application? Particularly I want to deploy MediaWiki. I searched its wiki, and didn't find such topic in its security page.

  • 2
    Well, remove them one by one and see what breaks...
    – Tom Leek
    Dec 28, 2013 at 14:44

1 Answer 1


Unless MediaWiki's documentation details which modules are required then there is no way to know other than by trial and error... as @Tom Leek suggested, disable them one by one. This can be a little tedious and time consuming but will achieve your goal. Some of the modules should be obvious though. For example, if the system is not a proxy you don't need mod_proxy. If you don't do any URL rewriting then you don't need mod_rewrite.

Hopefully the list of Apache modules with descriptions will help narrow the field more quickly.

  • I know this is an old question but maybe it'll help somebody else at some point. Feb 27, 2014 at 0:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .