Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

The access log on my web server has a ton of HTTP HEAD requests coming from porn sites. What are HEAD requests and are they doing something bad with my site?

Here is an excerpt from my log:

(valid request)

xxx.xxx.xxx.xxx - - [02/Jan/2011:23:42:25 -0800] "POST /ajax HTTP/1.1" 200 0 "http://www.mywebsite.com/abc.html" "Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7"
(weird requests)
xxx.xxx.xxx.xxx - - [02/Jan/2011:23:43:11 -0800] "HEAD / HTTP/1.0" 302 185 "http://www.somepornsite.com" "Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.25 (jaunty) Firefox/3.8"
xxx.xxx.xxx.xxx - - [02/Jan/2011:23:43:11 -0800] "HEAD /valid.html HTTP/1.0" 200 16871 "http://www.somepornsite.com" "Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.25 (jaunty) Firefox/3.8"

(Web and IP addresses in this log have been munged.)

share|improve this question
3  
There's a dirty joke in this, somewhere. :-) –  Chris W. Rea Jan 7 '11 at 1:18
    
must randomize ip addresses in the question –  abel Jan 7 '11 at 10:51
    
@Chris that was my first thought upon seeing the title, too :) –  Pekka 웃 Jan 7 '11 at 15:55
    
Thanks for all the replies. Hopefully this is just referrer spam. I will log the actual requests and see exactly what they are posting. –  Don Corley Jan 8 '11 at 0:01
add comment

2 Answers

Most likely attempts at referrer spam, but these could also be malicious (i.e. remote file inclusion attempts or contact form spam - particularly if you're running software which could be identified as vulnerable).

If possible, set up a script to log the post contents to see exactly what you're dealing with and get in touch with the ISP's hosting the domain(s) in question (particularly if this activity is adversely affecting your operation).

share|improve this answer
1  
As soon as I saw the question I thought referrer spam –  John Conde Jan 7 '11 at 3:55
2  
Just for clarification, another idea behind referrer spam is exactly what you've just done. "Oohh, this is a new site linking to me! I wonder what it is... clickety click... virus " - since I found that out I've never clicked a referrer's URL. –  Mark Henderson Jan 7 '11 at 4:11
    
@Farseeker - That's a great point - there are enough webmasters out there that I wouldn't be surprised if referrer spam pulled in as many hits as an e-mail spamming campaign. –  danlefree Jan 7 '11 at 5:39
add comment

To answer your first question: with a normal page request (GET), the server returns some header information containing the page encoding, language and various other details. The page's content (<!DOCTYPE html....) then follows as normal.

HEAD requests are simply requests for a URL that only return the header information. I believe this is normally used to check the status of files, for example seeing if a cached image should be updated. It's also useful for validating that you implemented certain features correctly like gzip or caching.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.