Web Server Hardening: nginx and Apache

Where the Configuration Really Lives

nginx reads one file, nginx.conf, and follows every include directive; Debian puts sites in sites-enabled and fragments in conf.d. Apache reads apache2.conf (Debian) or httpd.conf (RHEL) and follows Include and IncludeOptional. A directive set in a fragment can override the main file, so the assessor's view is the merged tree, which nginx -T and apachectl -t -D DUMP_CONFIG print. OpenVAPT builds the same merged view from the files, following includes only under the server's own configuration folder.

The configuration view complements the live probes in WEB-HDR and WEB-EXP. A probe sees one response; the file shows the rule and the line to fix, and it finds a weak setting before a site is published.

Banners, Listings and Methods

server_tokens off in nginx and ServerTokens Prod with ServerSignature Off in Apache drop the version from the Server header and error pages. Hiding the version does not fix old software, but there is no reason to publish it (OWASP WSTG-INFO-02). autoindex on and Options Indexes turn folders without an index page into file listings. Debian's default Apache block for /var/www enables Indexes, so a fresh install lists uploads until someone changes it. TraceEnable Off removes an HTTP method that echoes request headers, including cookies, and that nothing legitimate uses.

AllowOverride All lets any .htaccess file under the document root change handlers, options and access rules. Combined with an upload bug, that is how an image becomes a PHP script. AllowOverride None, or a short explicit list such as FileInfo Indexes Limit, keeps those decisions in root-owned configuration.

TLS the Mozilla Way

TLS 1.0 and 1.1 are deprecated by RFC 8996. nginx needs ssl_protocols TLSv1.2 TLSv1.3; Apache needs SSLProtocol -all +TLSv1.2 +TLSv1.3, because its default (all -SSLv3) still allows the old versions. The cipher list should be the short Mozilla intermediate set: ECDHE key exchange, AES-GCM or ChaCha20, nothing with RC4, DES, 3DES, MD5, NULL, export or anonymous suites. Both guidelines now set ssl_prefer_server_ciphers off and SSLHonorCipherOrder off, since every listed suite is strong and the client knows its own hardware best.

OCSP stapling (ssl_stapling on; SSLUseStapling On) lets the server attach a fresh revocation status to the handshake. This is faster and stops browsers telling the certificate authority which sites a user visits. The Mozilla profiles also turn nginx session tickets off, because a ticket key that never rotates weakens forward secrecy. The Mozilla SSL Configuration Generator produces a full configuration block for either server; paste it rather than typing cipher names.

Dot Files and Limits

A .git folder rebuilds the source and its history; a .env file holds the database password. Debian's Apache default protects only .ht* files. One rule per server covers the whole class: nginx location ~ /\. { deny all; } with a more specific location for /.well-known/ above it; Apache <DirectoryMatch "/\.(git|svn|hg)"> and <FilesMatch "^\.(env|git)"> with Require all denied. This also protects files deployed by mistake next year.

client_max_body_size and limit_req_zone in nginx bound what one client can upload and how fast it can hit a login page. ModSecurity with the OWASP Core Rule Set, or mod_evasive, adds request filtering to Apache. These are informational in OpenVAPT because the right numbers depend on the application; a filter that is never tuned breaks sites, and one that is never deployed blocks nothing.

In Summary

A web server is only as hard as its merged configuration. Hide banners and listings, and disable TRACE. Allow only TLS 1.2 and 1.3 with modern ciphers and stapling. Keep .htaccess overrides narrow, deny dot files everywhere, and bound request sizes and rates.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --only WEB-NGX-,WEB-APA- --out p15 and, for each finding, write the exact line in nginx.conf or apache2.conf that fixes it.
2. Compare /etc/nginx/nginx.conf and /etc/apache2/apache2.conf between the two labs (internal/lab/fixtures_servers_db_mail.go) and explain what each changed directive prevents.
3. On a test machine: nginx -T | grep -nE 'server_tokens|ssl_protocols|autoindex' and apachectl -t -D DUMP_CONFIG | grep -nE 'ServerTokens|SSLProtocol|Options' ; find the effective value and the file it came from.
4. Generate an intermediate profile for your server version at the Mozilla SSL Configuration Generator and list every directive it sets that your current configuration lacks.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• Mozilla, Server Side TLS guidelines
• Mozilla SSL Configuration Generator
• Apache HTTP Server, Security Tips
• nginx documentation, ngx_http_ssl_module
• NIST SP 800-52 Rev. 2, Guidelines for TLS Implementations
• OWASP Web Security Testing Guide, Configuration and Deployment Management Testing

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P18: Web Server Hardening: nginx and Apache (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p18.html

@misc{openvapt_p18,
  author       = {{OpenVAPT}},
  title        = {{P18: Web Server Hardening: nginx and Apache}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p18.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}