Dangerous HTTP methods and directory listing

Dangerous HTTP methods (PUT, DELETE, TRACE)

Vetora sends an OPTIONS request (standard, no side effect) and reads the Allow header your server itself returns — no dangerous method is actually executed during the scan. If that header lists PUT or DELETE, and those methods are really implemented without authentication, an attacker can modify or delete resources directly. TRACE poses a different risk (Cross-Site Tracing): combined with an XSS vulnerability elsewhere on the site, it can expose headers a script shouldn't be able to read.

On nginx, to explicitly block TRACE:

if ($request_method = TRACE) {
    return 405;
}

For PUT/DELETE, the right approach depends on your framework: either you simply don't implement them if you don't need them, or you restrict them to routes that check authentication before any processing.

Directory listing (autoindex)

When a folder like /uploads/ has no index page, some servers show the raw list of every file it contains by default — including ones you never meant to make public.

On nginx:

autoindex off;

On Apache:

Options -Indexes