A friend of mine was trying to sign into their T-Mobile account to pay their bill when they saw this strange message.

Welcome, first and last_name

Method Not Allowed The requested method POST is not allowed for the URL /apps/mytmobile/components/content/common/billing/balancedue. Apache/2.2.15 (Red Hat) Server at my.t-mobile.com Port 443

I don't think anyone needs to know what web server T-Mobile is using, nor what Linux distribution or port number. That would give a hacker a chance to try to log in.

I tried calling T-Mobile myself, but wasn't able to get a hold of anyone to report this problem.


The port number of websites is standard. Port 80 for HTTP websites and port 443 for HTTPS websites. Everyone knows this so giving that information away is fine.

As for the server software. Apache is one of the most used web servers, and as long as the website team at T-Mobile are on top of things and keep their servers fully patched, then it shouldn't be a concern.

There is some argument that hiding what server software you are running provides some security benefit. But this is called security through obscurity, and most security people don't consider it a form of protection at all. You'd be much better off keeping Apache fully patched and up to date at all times than rely on something that offers no real protection against a hacker who knows what they are doing. You might fool a script kiddie but no one else. Basically, it is more important to keep things patched than rely on removing the information about Apache. Of course, hiding it as well as keeping things up to date won't hurt.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.