Can I change the location of the Apache server status from a random value to something fixed?

Question

Starting in cPanel & WHM v136 (CPANEL-46581), the WHM Apache Status page location was changed from a fixed path to a randomly generated one for security purposes, for example:

CONFIG_TEXT: <Location /RANDOMSTRING>
SetHandler server-status

This value is stored in /var/cpanel/whm_server_status_key and regenerates each time the Apache configuration is rebuilt. Is it possible to set this to a fixed, unchanging value instead, for example to support a monitoring/collection tool that expects a stable URL?

Answer

Yes, it is possible to create a new entry in the global configuration to add a stable URL if this is required. 

Warning: The server-status path was randomized because, if guessed or discovered, it can be used to enumerate other users and domains on the server, which could in turn help identify other attack targets. Setting a fixed, predictable path removes that protection. This is not recommended as a general practice. If it's needed to support a specific tool, restrict access to the endpoint by other means (for example, IP-based access control) and evaluate the risk before proceeding.

To set a fixed location:

1. Edit the pre_main_global.conf file for Apache using WHM or the command-line. The following provides information on this process:

   How to Edit the Apache Configuration File

2. Add the following directive to this file:

   <IfModule status_module>
       <Location /whm-monitoring-status>
           SetHandler server-status
           Order deny,allow
           Deny from all
           Allow from 127.0.0.1 ::1
           <IfModule security2_module>
               SecRuleEngine Off
           </IfModule>
           <IfModule security3_module>
              modsecurity_rules 'SecRuleEngine Off'
           </IfModule>
       </Location>
   </IfModule>

   Note: In the above, the URL /whm-monitoring-status is only accessible via IPv4 127.0.0.1 and IPv6 ::1; which are the localhost IPs. It is recommended to limit this URL to only the IPs that require this information, such as from any external monitoring service.

3. Restart Apache:

   # /scripts/restartsrv_httpd