PUT DELETE enabled by default?

[frist44]

I have read that these methods aren't enabled unless you load mod_dav, is this true?

We have a simple web server hosting up PHP, and just want to make sure those commands can not be run.

thanks.

[jdMorgan]

This is determined by your hosting company's "default" server configuration.

Without DAV, those HTTP methods may not actually *do* anything, but you might want to restrict them anyway. See the Deny directive in Apache mod_access and the <Limit> container described in the Apache core documentation.

Jim

[frist44]

We host our own machines. I have added the Limit directive, so I guess that should protect it worst case right?

[jdMorgan]

<Limit> isn't a directive, it's a qualifier container. I can't answer your question without seeing the code.

Jim