Practically, however, most users download a binary executable and never look at the source code, or merely give it a cursory look before compiling and installing it. Users assume that someone more conscientious than themselves has carefully studied the code. There are several problems with this method. As described above, Internet addresses and domain names are a weak identification method. Also, unless you can configure an attack computer with various addresses, it is difficult to tell if your configuration rules are correct or if the Web server author implemented the access control algorithms correctly.
Web servers support dozens of optional features.
The most popular features are usually the best debugged, since other people have already discovered the problems. If you use little-used or experimental features, you are the guinea pig. Unfortunately, it's easy to create insecure CGI programs that allow an attacker to trick the Web server into executing other programs. If the Web server is broken into, it can serve as a stepping stone to break into other networks and systems in the organization. The privacy of the organization and its customers can be violated if confidential data are kept on the Web server.