DEV Community

Ravi Kyada
Ravi Kyada

Posted on • Originally published at towardsaws.com on

Ultimate Guide to Apache Security: Hide Server Details, Restrict Access & Harden Your Setup

#vulnerability #malware #security #websecurity


Ultimate Guide to Apache Security: Hide Server Details, Restrict Access & Harden Your Setup

Apache is one of the most widely used web servers globally, but its default settings can leave your website vulnerable to attacks.

If you’re not actively securing your Apache setup, you’re leaving the door open for cybercriminals.

This guide will walk you through hiding Apache server details, restricting access, and implementing advanced security measures for Apache, PHP, Laravel, WordPress, and other technologies to keep your web applications safe.

1. Understanding Apache Security Risks

Why Default Settings Are Dangerous

Out of the box, Apache reveals critical information, such as:

  • Apache version and OS details
  • Enabled modules and directory structure
  • Potentially sensitive files like **.git/config and ***.htaccess*

Attackers use this information to identify vulnerabilities and launch exploits. Your goal is to minimize exposure and harden Apache against threats.

2. Hiding Apache Server Information

Prevent Server Version & OS Exposure

To hide Apache’s version number and OS details , update your configuration file (apache2.conf or httpd.conf):

ServerSignature Off
ServerTokens Prod
Enter fullscreen mode Exit fullscreen mode
  • ServerSignature Off: Removes Apache version from error pages.
  • ServerTokens Prod: Only displays "Apache" without version or OS details.

Now Restart Apache after Apache2 configuration changes:

sudo systemctl restart apache2
Enter fullscreen mode Exit fullscreen mode

Disable Directory Listing

Prevent Apache from listing directory contents:

Options -Indexes
Enter fullscreen mode Exit fullscreen mode

3. Restricting Access to Sensitive Files

Block .git and Other Sensitive Directories

Add the following rules to prevent unauthorized access to .git, .htaccess, .env, and other sensitive files:

<DirectoryMatch "/(\.git|\.htaccess|\.env)/">
    Require all denied
</DirectoryMatch>
Enter fullscreen mode Exit fullscreen mode

Secure .htaccess File

Ensure that .htaccess cannot be accessed publicly:

<Files ".htaccess">
    Require all denied
</Files>
Enter fullscreen mode Exit fullscreen mode

4. Secure Headers Configuration

Enhance security by adding these headers to prevent common attacks like clickjacking and XSS:

Header always set X-Frame-Options "DENY"
Header always set X-Content-Type-Options "nosniff"
Header always set X-XSS-Protection "1; mode=block"
Header always set Content-Security-Policy "default-src 'self'"
Enter fullscreen mode Exit fullscreen mode

Restart Apache to apply changes:

sudo systemctl restart apache2
Enter fullscreen mode Exit fullscreen mode

5. Disabling Unused Apache Modules

Reduce attack surfaces by disabling unnecessary modules:

sudo a2dismod autoindex status
sudo systemctl restart apache2
Enter fullscreen mode Exit fullscreen mode

Check enabled modules:

apachectl -M
Enter fullscreen mode Exit fullscreen mode

6. Implementing HTTPS with SSL/TLS

Use Let’s Encrypt to enable HTTPS:

sudo apt install certbot python3-certbot-apache
sudo certbot --apache
Enter fullscreen mode Exit fullscreen mode

7. Rate Limiting & DDoS Protection

Use mod_evasive to block rapid requests:

sudo apt install libapache2-mod-evasive
Enter fullscreen mode Exit fullscreen mode

Enable and configure it:

<IfModule mod_evasive.c>
    DOSHashTableSize 3097
    DOSPageCount 5
    DOSSiteCount 50
    DOSBlockingPeriod 600
</IfModule>
Enter fullscreen mode Exit fullscreen mode

Restart Apache:

sudo systemctl restart apache2
Enter fullscreen mode Exit fullscreen mode

8. Security Best Practices for PHP

Disable Dangerous Functions

Edit php.ini to prevent remote code execution:

disable_functions = exec, system, shell_exec, passthru, eval
Enter fullscreen mode Exit fullscreen mode

Hide PHP Version 

expose_php = Off
Enter fullscreen mode Exit fullscreen mode

Restart PHP:

sudo systemctl restart php-fpm
Enter fullscreen mode Exit fullscreen mode

9. Laravel Security Enhancements

Secure .env File

Deny public access to .env:

<Files ".env">
    Require all denied
</Files>
Enter fullscreen mode Exit fullscreen mode

Use Laravel Security Middleware

Enable CORS protection, rate limiting, and CSRF protection :

protected $middleware = [
    \App\Http\Middleware\VerifyCsrfToken::class,
    \App\Http\Middleware\CorsMiddleware::class,
];
Enter fullscreen mode Exit fullscreen mode

10. WordPress Security Enhancements

Block XML-RPC Attacks

Disable XML-RPC to prevent brute-force attacks:

<Files xmlrpc.php>
    Require all denied
</Files>
Enter fullscreen mode Exit fullscreen mode

Restrict Access to wp-config.php 

<Files wp-config.php>
    Require all denied
</Files>
Enter fullscreen mode Exit fullscreen mode

Install Security Plugins

Use Wordfence or iThemes Security for additional protection.

11. Keeping Software Updated

Regularly update Apache, PHP, Laravel, and WordPress:

sudo apt update && sudo apt upgrade -y
Enter fullscreen mode Exit fullscreen mode

Set up automatic security updates:

sudo apt install unattended-upgrades
Enter fullscreen mode Exit fullscreen mode

Conclusion

Securing Apache, PHP, Laravel, and WordPress is crucial to protect your data, users, and infrastructure.

Following these steps reduces attack surfaces, prevents unauthorized access, and fortifies your web applications against cyber threats.

FAQ

1. How do I check if Apache is exposing server details?

Run this command:

curl -I -s yourwebsite.com | grep Server
Enter fullscreen mode Exit fullscreen mode

If you see “Apache/2.x.x”, your server details are exposed.

2. How do I test if my .git directory is public?

Visit:

https://yourwebsite.com/.git/config
Enter fullscreen mode Exit fullscreen mode

If it loads, your repository is exposed and must be secured immediately.

3. Can disabling unnecessary Apache modules improve performance?

Yes! Reducing unused modules lowers memory usage and speeds up requests.

4. Why is HTTPS necessary for security?

HTTPS encrypts data between the server and users, preventing man-in-the-middle attacks and data leaks.

5. How do I monitor security threats in Apache?

Use Fail2Ban to block malicious IPs:

sudo apt install fail2ban
Enter fullscreen mode Exit fullscreen mode

By implementing these best practices, your Apache server, PHP applications, Laravel projects, and WordPress sites will be significantly more secure. 🚀

Top comments (0)