Apache status URL

anton_latvia

• August 06, 2026 06:35

For years apache status was available at /whm-server-status. Suddenly on all (or most) server this got changed to some random string. Is it a super-security feature? Is this string configurable per server? Was there announcement? 

• 

  mtindor

  • August 06, 2026 11:43

  It's now just /server-status .   And you can enable/disable it in Tweak Settings in WHM

  0
• 

  anton_latvia

  • August 06, 2026 11:45

  No, /server-status is giving us 404-error. and in httpd.conf I clearly see random URLs for the server status page.

  0
• 

  mtindor

  • August 06, 2026 12:25

  Well,I know on all of my servers it's /server-status and is set/activated in Tweak Settings.   Did you check Tweak Settings?

  0
• 

  anton_latvia

  • August 06, 2026 12:49

  there are no options to set name, it's just enabled. never been /server-status. we're collecting these stats for more than 5 years, so i am pretty sure.

  0
• 

  cPRex Jurassic Moderator

  • August 06, 2026 15:50

  I'm not seeing other reports of this being a random string either, so you may need to submit a ticket for this to be examined.

   

  0
• 

  Anton Aleksandrov

  • August 07, 2026 11:57

  Support team told me now, that in version 136 "whm-server-status" has been removed and obfuscaed, as described in CPANEL-46581. I would like to state, that this is annoying and very problematic situation, as it causes our monitoring scripts to stop working. @cPRex - man, we've been with cPanel for years - why again this frustration? I have expressed my dissatisfaction to support team, but I don't think it matters to anyone.

  for those who need it - just add server-status block to Apache includes.

  0
• 

  cPRex Jurassic Moderator

  • August 07, 2026 15:39

  Anton Aleksandrov - can you share that ticket number?

  0
• 

  Anton Aleksandrov

  • August 07, 2026 15:41

  96055044 

  0
• 

  cPRex Jurassic Moderator

  • August 10, 2026 13:23

  Thanks for that information - it looks our team was able to explain the security implications that were discovered on the old URL through the ticket and that's why the change had to be made.

  I do see that the support supervisor submitted a feature request to see if the functionality could be restored *without* changing the URL, but I'm not sure of any type of ETA on when I'll hear back about this.

  At this point I don't have any other updates to share but I will be sure to bring up that request with the team in a future meeting.

  0
• 

  Anton Aleksandrov

  • August 12, 2026 06:02

  yeah, explanation is good and sensible from one point of view, but it does break a lot for us. I don't think there are many ways for fix this, may be some sort of HTTP authentication.. Although for me that does not seem like super critical issue. I would prefer a configuration setting - to set status URL or to have it auto-generated-obfuscated. Then each customer can decide for their own, rather than having this pushed on us. And as I mentioned - I will have to override it through includes anyway.

  0

Please sign in to leave a comment.