I am getting an alert
CWP Security Audit - mod_auth_form enabled
LoadModule auth_form_module is active in /usr/local/apache/conf/httpd.conf_backup . CWP does not use this module and it is often enabled by malware. Check /usr/local/apache/modules/mod_auth_form.so and the server for a compromise.
Any recommended steps?
Also got today, it's a backup file and no longer in use by my system so I removed it.
That was mentioned in the changelog -- mod_auth_form.so is often used by casino SEO malware, a fake Apache module that re-writes web requests if the client is a bot. Your old httpd conf backup was referencing it. You could clean up that line in the old httpd conf.