32. Linux and Network Hardening

32.5 Web Server Hardening

By Ravindra Bagale · Last updated: 27 September 2026

Apache (/etc/httpd/conf/httpd.conf or a file in /etc/httpd/conf.d/):

ServerTokens Prod
ServerSignature Off
TraceEnable Off
<Directory /var/www/html>
    Options -Indexes -Includes
    AllowOverride None
</Directory>
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Content-Security-Policy "default-src 'self'"

Nginx (inside http {} or the server {} block):

server_tokens off;
autoindex off;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
client_max_body_size 10m;
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;

PHP (/etc/php.ini): expose_php = Off, display_errors = Off, allow_url_include = Off, and disable_functions = exec,passthru,shell_exec,system if your app does not need them.

Always keep HTTPS with a valid certificate (Chapter 11) and redirect HTTP to HTTPS. Test and reload:

sudo apachectl configtest && sudo service httpd reload
sudo nginx -t && sudo service nginx reload
curl -I https://reels.example.in        # check the headers

A WAF (web application firewall) such as ModSecurity or AWS WAF adds another layer against SQLi and XSS, but it never replaces fixing the code (Chapter 29).