Should I disable HTTP HEAD requests?

Question

I have seen increased 'HEAD' requests in my webserver access.log. What are these requests for? Should I disable this method in my webserver configs?

Answer 1

No.

Relevant quote from the link:

HEAD

Asks for the response identical to the one that would correspond to a GET request, but without the response body. This is useful for retrieving meta-information written in response headers, without having to transport the entire content.

If you disabled it, you'd just increase your throughput cost. A person can get the same information with a GET, so if they were trying to do something malicious, they could just use a GET. Except, this way, they're being nice and not forcing you to send the request body.

EDIT: I don't know what the requests would be from, although I can certainly think of uses. Anyone else who knows or wants to chip in, please do so. I'm kinda curious, myself. Hence, community wiki.

Answer 2

Everything Parthian said was spot on. HEAD requests are a like a 'short' GET request that avoids the network extra traffic and potentially the rendering overhead of a GET request.

There are a variety of reasons you, your browser, or your search engine may want to do a HEAD request. Some websites may just be pulling meta information off you, and your smaller response is to your benefit. More likely your browser or search engines are probably using HEAD requests to see if their cached versions of your pages are still up to date.

The Response header's "date" and "expires" field should be used by clients when your page is cached to determine when the next time they should visit your site for an update. Also the response headers may sometimes include a modified date that could also be used to indicate when your page needs to be updated.

Answer 3

NMAP Uses HEAD Requests in Script: 'http-security-headers'

A common technique in penetration testing is to confirm HSTS secure connections over HTTPS by using the NMAP command below, which uses HEAD vs. GET requests. Blocking HEAD requests can cause this test to falsely report that HSTS is not configured properly.

$ nmap -p 443 --script http-security-headers your.domain.com
Starting Nmap 7.80 ( https://nmap.org ) at 2022-05-16 22:33 UTC
Nmap scan report for your.domain.com (xxx.xxx.xxx.xxx)
Host is up (0.026s latency).
rDNS record for XXX

PORT    STATE SERVICE
443/tcp open  https
| http-security-headers:
|   Strict_Transport_Security:
|     HSTS not configured in HTTPS Server
|   Cookie:
|     Cookies are secured with Secure Flag in HTTPS Connection
|   Cache_Control:
|_    Header: Cache-Control: private

Answer 4

Yes.

In information security circles, the HEAD method, while admittedly useful in some situations, allows requests to bypass security constraints.

It should be disabled

Nessus comments on the security issues with HEAD.

OWASP reports how it can be used to create new users on a system remotely.

Answer 5

You block the head request and you watch for increases in GET or HEAD request from the scummy scrapers.. THEN YOU BLOCK THEIR IPS. Funny thing is that their BOTS are so STUPID that they don't take the hint and keep coming back for more attempts. At which point you send them off on a 301 redirection to some where else ( ie someone elses web site and bandwidth. Take for example that 98% of all INTERNET search traffic comes from just Google (86% market share ) and BING and YAHOO taking up the remaining 12% ) - there is ABSOLUTELY NO REASON TO ALLOW ALL THE SCUMMY head tester to have any access. You don't need them ! They are expendable. And there is no reason to encourage their traffic.

My site handles close to 1 million visitors per day... of the 1 million -500,000 are from pointless content scrapers and barely used search engines. By blocking those clowns I free up 50% of my bandwidth and server cycles to handle the LEGIT traffic. Its too bad that the clever campers behind Apache and Linus never gave us a NULL that we could send the useless traffic off to.