Ravindra BagaleCourses & study guides

8. Hosting a Static Website and Changing the Configuration

8.9 Basic Hardening of a Static Web Server

By Last updated:

Site chalu zali – aata thodi surakshit karuya. He badal chhote aahet pan Nikto sarkhe scanners lagech pakadtat.

# Nginx – in the http { } block of nginx.conf
server_tokens off;                                  # hide version number
# in each server block
autoindex off;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
location ~ /\.(?!well-known) { deny all; }          # block .git, .env, .htaccess

# Apache – /etc/httpd/conf.d/security.conf (Ubuntu: conf-available/security.conf)
ServerTokens Prod
ServerSignature Off
TraceEnable Off
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
<DirectoryMatch "/\.(?!well-known)">
    Require all denied
</DirectoryMatch>

curl -I http://localhost          # check: no version in the Server header, new headers present

On Ubuntu Apache, enable the headers module first with sudo a2enmod headers.

Why this matters for security

Hiding versions does not fix vulnerabilities, but it removes free information. Blocking dot-files stops leaks of .git/ (entire source code) and .env (passwords) – both are among the first things web scanners request.

Ravindra Bagale's Tip

Khup students .git folder saha purna project web root madhe git clone kartat – aani kuni hi /.git/config download karu shakto. Web root madhe fakt public files theva, kiwa dot-files block kara. He mi pratyek batch la sangto, lakshat theva.

Practice task

Before and after hardening, run curl -I http://<PUBLIC_IP> and compare headers. Create /var/www/mysite/.env with dummy text and confirm it returns 403.

Thodkyaat sangaycha tar

  • Upload to home, sudo cp to /var/www/<site>, folders 755, files 644.
  • Amazon Linux: site files in conf.d/; Ubuntu: sites-available + enable (symlink or a2ensite), disable the default site.
  • Document root: Nginx root; Apache DocumentRoot + matching <Directory>. SELinux label for paths outside /var/www.
  • New port: listen / Listen, security group rule, SELinux port label on CentOS.
  • Index page: index / DirectoryIndex; keep listing off.
  • Harden: hide versions, security headers, block dot-files. Test before reload, every time.

Samjla ka? Tumchi website live aahe – congratulations! Part 3 sampla. Aata pudhe jaauya dynamic websites – PHP, LAMP aani LEMP kade.