Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

BREACH, a new attack on SSL that targets HTTP compression, has recently been publicly announced. The emerging advice for how to defend against BREACH seems to be: turn off HTTP compression.

So, how do I turn off HTTP compression? What changes do I need to make to my Apache configuration? Do I need to make any changes to browsers, too?

(While I'm here, are there any other resources suggesting what changes should be made on other web servers, like Microsoft IIS?)

share|improve this question

migrated from Aug 3 '13 at 3:36

This question came from our site for information security professionals.

up vote 6 down vote accepted

Apache compression is handled by mod_deflate. Just don't load or enable the module and Apache won't apply HTTP compression. Other compression (such as done within PHP) may be a bit more complicated, but BREACH deals specificly with mod_deflate-style compression.

There is also mod_gzip, which is much less popular.

share|improve this answer
Don't just switch to gzip; you can be sure this attack will be adapted quickly enough. – Michael Hampton Aug 3 '13 at 16:18
@MichaelHampton The point wasn't switch to mod_gzip, but rather also disable mod_gzip. – tylerl Aug 3 '13 at 18:59
Note that if you serve both secure and non-secure content (whether this is a good practice is a different discussion, but I digress), this will disable compression for all content, which may not be what you want. – Moshe Katz Aug 8 '13 at 0:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.