Apache status URL

anton_latvia

• August 06, 2026 06:35

For years apache status was available at /whm-server-status. Suddenly on all (or most) server this got changed to some random string. Is it a super-security feature? Is this string configurable per server? Was there announcement? 

• 

  mtindor

  • August 06, 2026 11:43

  It's now just /server-status .   And you can enable/disable it in Tweak Settings in WHM

  0
• 

  anton_latvia

  • August 06, 2026 11:45

  No, /server-status is giving us 404-error. and in httpd.conf I clearly see random URLs for the server status page.

  0
• 

  mtindor

  • August 06, 2026 12:25

  Well,I know on all of my servers it's /server-status and is set/activated in Tweak Settings.   Did you check Tweak Settings?

  0
• 

  anton_latvia

  • August 06, 2026 12:49

  there are no options to set name, it's just enabled. never been /server-status. we're collecting these stats for more than 5 years, so i am pretty sure.

  0
• 

  cPRex Jurassic Moderator

  • August 06, 2026 15:50

  I'm not seeing other reports of this being a random string either, so you may need to submit a ticket for this to be examined.

   

  0
• 

  Anton Aleksandrov

  • August 07, 2026 11:57

  Support team told me now, that in version 136 "whm-server-status" has been removed and obfuscaed, as described in CPANEL-46581. I would like to state, that this is annoying and very problematic situation, as it causes our monitoring scripts to stop working. @cPRex - man, we've been with cPanel for years - why again this frustration? I have expressed my dissatisfaction to support team, but I don't think it matters to anyone.

  for those who need it - just add server-status block to Apache includes.

  0
• 

  cPRex Jurassic Moderator

  • August 07, 2026 15:39

  Anton Aleksandrov - can you share that ticket number?

  0
• 

  Anton Aleksandrov

  • August 07, 2026 15:41

  96055044 

  0
• 

  cPRex Jurassic Moderator

  • August 10, 2026 13:23

  Thanks for that information - it looks our team was able to explain the security implications that were discovered on the old URL through the ticket and that's why the change had to be made.

  I do see that the support supervisor submitted a feature request to see if the functionality could be restored *without* changing the URL, but I'm not sure of any type of ETA on when I'll hear back about this.

  At this point I don't have any other updates to share but I will be sure to bring up that request with the team in a future meeting.

  0
• 

  Anton Aleksandrov

  • August 12, 2026 06:02

  yeah, explanation is good and sensible from one point of view, but it does break a lot for us. I don't think there are many ways for fix this, may be some sort of HTTP authentication.. Although for me that does not seem like super critical issue. I would prefer a configuration setting - to set status URL or to have it auto-generated-obfuscated. Then each customer can decide for their own, rather than having this pushed on us. And as I mentioned - I will have to override it through includes anyway.

  0
• 

  cPRex Jurassic Moderator

  • August 25, 2026 17:27

  Update - I did reach out to the developers about this issue and it's not something they want to change or revert at this time.  I'm sorry I don't have better news on this one.

  0
• 

  Anton Aleksandrov

  • August 25, 2026 18:04

  thank you, @cPRex, for update and effort. Solution is to manually add needed block to apache includes. There are so many nice features, that could have been implemented and are really needed (for years).. This one has easy fix - so not a biggie. Greetings to developers.

  0

Please sign in to leave a comment.