Hardening Apache2 Against Common Attacks

A default Apache install leaks more information than it should and has a few settings worth changing before going live on any public-facing server.

# Hide Apache version and OS details from error pages and headers
ServerTokens Prod
ServerSignature Off

# Disable directory listing globally
<Directory /var/www>
    Options -Indexes
</Directory>

# Block access to hidden files and common sensitive files
<FilesMatch "^\.">
    Require all denied
</FilesMatch>
<FilesMatch "\.(bak|config|sql|env)$">
    Require all denied
</FilesMatch>

# Disable the TRACE method (used in some XSS/session-hijacking attacks)
TraceEnable off

# Disable modules you don't actually use - smaller attack surface
sudo a2dismod status autoindex
sudo apache2ctl configtest
sudo systemctl reload apache2

ServerTokens Prod alone removes the exact Apache version and installed modules from every response header and error page — small effort, meaningfully reduces the information available to an attacker doing reconnaissance.

Hardening Apache2 Against Common Attacks

Recommended

Categories