title: Disable TRACK/TRACE apache
body: <p>I have a question about TRACK/TRACE HTTP Methods.
  I disabled TRACE from httpd.conf with TraceEnable Off.
  When I try and test if it really is disabled this is what I get:</p>
  
  <pre><code>&lt; HTTP/1.1 405 Method Not Allowed
  </code></pre>
  
  <p>However, the full code is still returned. Is this normal?
  When I test the TRACE method on google site I get an html containing 405 Method not Allowed.</p>
  
  <p>I am running 2 sites on this server, Apache with Nginx reverse proxy. One with SSL and one without.</p>
  
  <p>The non SSL returns 405 Method Not Allowed, both in Header Response and in HTML code.</p>
  
  <p>The SSL one, returns 405 in Header Response but with full html code ( main page )</p>
  
  <p>Any help would be appreciated.</p>
  
  <p>Thank you!</p>
  
  <p>Edit:
  Response for non SSL</p>
  
  <pre><code>* Connected to example.com (xx.xx.xx.xx) port 80 (#0)
  &gt; TRACE / HTTP/1.1
  &gt; User-Agent: curl/7.35.0
  &gt; Host: example.com
  &gt; Accept: */*
  &gt; 
  &lt; HTTP/1.1 405 Not Allowed
  * Server nginx admin is not blacklisted
  &lt; Server: nginx admin
  &lt; Date: Mon, 08 Jun 2015 11:26:45 GMT
  &lt; Content-Type: text/html
  &lt; Content-Length: 166
  &lt; Connection: close
  &lt; 
  &lt;html&gt;
  &lt;head&gt;&lt;title&gt;405 Not Allowed&lt;/title&gt;&lt;/head&gt;
  &lt;body bgcolor="white"&gt;
  &lt;center&gt;&lt;h1&gt;405 Not Allowed&lt;/h1&gt;&lt;/center&gt;
  &lt;hr&gt;&lt;center&gt;nginx&lt;/center&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  * Closing connection 0
  </code></pre>
  
  <p>Response of SSL site:</p>
  
  <pre><code>* Connected to www.example.com (xx.xx.xx.xx) port 443 (#0)
  * successfully set certificate verify locations:
  *   CAfile: none
    CApath: /etc/ssl/certs
  * SSLv3, TLS handshake, Client hello (1):
  * SSLv3, TLS handshake, Server hello (2):
  * SSLv3, TLS handshake, CERT (11):
  * SSLv3, TLS handshake, Server key exchange (12):
  * SSLv3, TLS handshake, Server finished (14):
  * SSLv3, TLS handshake, Client key exchange (16):
  * SSLv3, TLS change cipher, Client hello (1):
  * SSLv3, TLS handshake, Finished (20):
  * SSLv3, TLS change cipher, Client hello (1):
  * SSLv3, TLS handshake, Finished (20):
  * SSL connection using ECDHE-RSA-AES256-GCM-SHA384
  * Server certificate:
  *    subject: OU=GT45927005; OU=See www.rapidssl.com/resources/cps (c)15; OU=Domain Control Validated - RapidSSL(R); CN=www.smartnation.ro
  *    start date: 2015-05-03 09:14:54 GMT
  *    expire date: 2016-05-05 19:37:10 GMT
  *    issuer: C=US; O=GeoTrust Inc.; CN=RapidSSL SHA256 CA - G3
  *    SSL certificate verify ok.
  &gt; TRACE / HTTP/1.1
  &gt; User-Agent: curl/7.35.0
  &gt; Host: www.example.com
  &gt; Accept: */*
  &gt; 
  &lt; HTTP/1.1 405 Method Not Allowed
  &lt; Date: Mon, 08 Jun 2015 11:30:55 GMT
  * Server Apache/2.2.26 (Unix) mod_ssl/2.2.26 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 is not blacklisted
  &lt; Server: Apache/2.2.26 (Unix) mod_ssl/2.2.26 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
  &lt; Expires: Thu, 19 Nov 1981 08:52:00 GMT
  &lt; Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  &lt; Pragma: no-cache
  &lt; X-Pingback: https://www.example.com/xmlrpc.php
  &lt; Set-Cookie: PHPSESSID=6b7fbfb366741438c07a9041452ea469; path=/
  &lt; Set-Cookie: _pmxi_session=%7C%7C%7C%7C; path=/
  &lt; Connection: close
  &lt; Transfer-Encoding: chunked
  &lt; Content-Type: text/html; charset=UTF-8
  &lt; 
  &lt;!DOCTYPE html&gt;
  
  &lt;!--[if lt IE 7 ]&gt;&lt;html class="ie ie6" lang="en"&gt; &lt;![endif]--&gt;
  
  &lt;!--[if IE 7 ]&gt;&lt;html class="ie ie7" lang="en"&gt; &lt;![endif]--&gt;
  
  &lt;!--[if IE 8 ]&gt;&lt;html class="ie ie8" lang="en"&gt; &lt;![endif]--&gt;
  
  &lt;!--[if (gte IE 9)|!(IE)]&gt;&lt;!--&gt;&lt;html lang="en"&gt; &lt;!--&lt;![endif]--&gt;
  
  &lt;head&gt;
  
      &lt;meta charset="utf-8"&gt;
  
      &lt;meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=no" /&gt;
  
      &lt;meta name="apple-mobile-web-app-capable" content="yes" /&gt;
  
      &lt;meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"&gt;
  
      &lt;meta http-equiv="content-language" content="en" /&gt;
  etc...
  </code></pre>
  
  <p>Edit 2:
  Config files (httpd.conf and nginx)</p>
  
  <pre><code>Listen 0.0.0.0:8081
  Listen [::]:8081
  Listen 0.0.0.0:443
  Listen [::]:443
  &lt;VirtualHost xx.xx.xx.xx:8081&gt;
      ServerName example.com
      ServerAlias www.example.com
      DocumentRoot /home/account/public_html
      ServerAdmin webmaster@example.com
      UseCanonicalName Off
      #CustomLog /usr/local/apache/domlogs/example.com combined
      #CustomLog /usr/local/apache/domlogs/example.com-bytes_log "%{%s}t %I .\n%{%s}t %O ."
      ## User account # Needed for Cpanel::ApacheConf
      UserDir enabled account
      &lt;IfModule mod_suphp.c&gt;
          suPHP_UserGroup account account
      &lt;/IfModule&gt;
      &lt;IfModule !mod_disable_suexec.c&gt;
          &lt;IfModule !mod_ruid2.c&gt;
              SuexecUserGroup account account
          &lt;/IfModule&gt;
      &lt;/IfModule&gt;
      &lt;IfModule mod_ruid2.c&gt;
          RMode config
          RUidGid account account
      &lt;/IfModule&gt;
      &lt;IfModule itk.c&gt;
          # For more information on MPM ITK, please read:
          #   http://mpm-itk.sesse.net/
          AssignUserID account account
      &lt;/IfModule&gt;
      ScriptAlias /cgi-bin/ /home/account/public_html/cgi-bin/
  
  
      # To customize this VirtualHost use an include file at the following location
      # Include "/usr/local/apache/conf/userdata/std/2/account/example.com/*.conf"
  
  &lt;/VirtualHost&gt;
  &lt;VirtualHost xx.xx.xx.xx:443&gt;
      ServerName example.com
      ServerAlias www.example.com
      DocumentRoot /home/account/public_html
      ServerAdmin webmaster@example.com
      UseCanonicalName Off
      #CustomLog /usr/local/apache/domlogs/example.com combined
      #CustomLog /usr/local/apache/domlogs/example.com-bytes_log "%{%s}t %I .\n%{%s}t %O ."
      ## User natsmart # Needed for Cpanel::ApacheConf
      UserDir enabled account
      &lt;IfModule mod_suphp.c&gt;
          suPHP_UserGroup account account
      &lt;/IfModule&gt;
      &lt;IfModule !mod_disable_suexec.c&gt;
          &lt;IfModule !mod_ruid2.c&gt;
              SuexecUserGroup account account
          &lt;/IfModule&gt;
      &lt;/IfModule&gt;
      &lt;IfModule mod_ruid2.c&gt;
          RMode config
          RUidGid account account
      &lt;/IfModule&gt;
      &lt;IfModule itk.c&gt;
          # For more information on MPM ITK, please read:
          #   http://mpm-itk.sesse.net/
          AssignUserID account account
      &lt;/IfModule&gt;
      ScriptAlias /cgi-bin/ /home/account/public_html/cgi-bin/
      SSLEngine on
  
      SSLCertificateFile /var/cpanel/ssl/installed/certs/www_example_com_dfe76_6dcdf_1462477030_fd971317dfc02602ec168052ed2c7119.crt
      SSLCertificateKeyFile /var/cpanel/ssl/installed/keys/dfe76_6dcdf_d9471fcd7e80d319080f6db604599d49.key
      SSLCACertificateFile /var/cpanel/ssl/installed/cabundles/GeoTrust_Inc__6473a1b25f37e0f134912eb5d8d02a9c_1653082772.cabundle
      #CustomLog /usr/local/apache/domlogs/example.com-ssl_log combined
      SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
      &lt;Directory "/home/account/public_html/cgi-bin"&gt;
          SSLOptions +StdEnvVars
      &lt;/Directory&gt;
  
      # To customize this VirtualHost use an include file at the following location
      # Include "/usr/local/apache/conf/userdata/ssl/2/account/example.com/*.conf"
  
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>Nginx:</p>
  
  <pre><code>server {
            error_log /var/log/nginx/vhost-error_log warn;
            listen xx.xx.xx.xx:80;
            listen [::]:80;
            server_name example.com www.example.com;
            access_log /usr/local/apache/domlogs/example.com-bytes_log bytes_log;
            access_log /usr/local/apache/domlogs/example.com combined;
            root /home/account/public_html;
            #location / {
            location ~*.*\.(3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|flv|html|htm|txt|js|css|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso)$ {
            expires 1M;
            try_files $uri @backend;
            }
            location / {
        error_page 405 = @backend;
            add_header X-Cache "HIT from Backend";
            proxy_pass http://xx.xx.xx.xx:8081;
            include proxy.inc;
        include microcache.inc;
            }
            location @backend {
            internal;
            proxy_pass http://xx.xx.xx.xx:8081;
            include proxy.inc;
        include microcache.inc;
            }
            location ~ .*\.(php|jsp|cgi|pl|py)?$ {
            proxy_pass http://xx.xx.xx.xx:8081;
            include proxy.inc;
        include microcache.inc;
            }
            location ~ /\.ht {
            deny all;
            }
          }
  </code></pre>