: Apache2 Unwantingly Allowing Proxy Requests I'm not sure if this is the right location, but this is fairly urgent. I have completely removed all traces of mod_proxy and the other mod_proxy

@Rambettina238

(from our emails, just to answer the question for future users)

Looking at your last line (access log) it seems that people are exploiting a remote-file-inclusion hole, rather than proxying via Apache directly. But you can be sure of this by forcing all possible proxy capabilities to be disabled.

You can try yourself to use your server as a proxy to access other sites and make sure that you get either a failure, or local content from your site. Among the ways to do this:

Configure your browser to use your web server as its default proxy server and then try to request foreign sites. You should get only your own website content back in reply.
Manually construct requests using telnet:

telnet yoursite.example.com 80
GET www.google.com/ HTTP/1.1
Host: google.com

Then press enter twice. If your server is properly configured, you should receive content from your own site and not Google. Source: apache.org
Failing that, still try this in the main config:

ProxyRequests On
ProxyVia On
<Proxy *>
Order deny,allow
Deny from all
Allow from none
AllowOverride none
</Proxy>

Vote Up Vote Down