Keep the system and Apache updated for security patches; 2. Disable unused modules (such as status, autoindex) to reduce the attack surface; 3. Hide Apache version and operating system information to prevent information leakage; 4. Force HTTPS and configure strong TLS encryption; 5. Disable directory listing and restrict file access; 6. Set correct file owners and permissions (such as www-data, 644/755); 7. Enable mod_security and mod_evasive to defend against web attacks and DDoS; 8. Enable logging and monitor regularly to detect abnormal behaviors—through these steps, you can significantly improve Apache security and build an effective protection foundation.

Securing Apache on a Linux server is essential to protect your web applications from common threats like unauthorized access, data leaks, and DDoS attacks. Here's a practical, step-by-step guide to harden your Apache installation:

? 1. Keep Apache and the System Updated

Always ensure your system and Apache are up to date:

 sudo apt update && sudo apt upgrade # Debian/Ubuntu
sudo yum update # CentOS/RHEL (older)
sudo dnf update # CentOS/RHEL (newer)

Updates often include critical security patches—don't skip them.

? 2. Disable Unused Modules

Apache loads many modules by default—some you may never use. Each adds potential attack surface.

Check enabled modules:

 apache2ctl -M # Debian/Ubuntu
httpd -M # RHEL/CentOS

Disable unecessary ones (eg, status , autoindex , userdir ):

 sudo a2dismod status autoindex userdir
sudo systemctl restart apache2

Why? Modules like mod_userdir allows users to host personal sites ( http://yoursite/~username )—a common misconfiguration risk.

?? 3. Hide Apache Version and OS Info

By default, Apache leaks version and OS info in HTTP headers and error pages—useful for attackers.

Edit your Apache config ( /etc/apache2/apache2.conf or /etc/httpd/conf/httpd.conf ):

 ServerTokens Prod
ServerSignature Off

• Prod → Only shows "Apache" in headers
• Off → Removes server info from error pages

Then restart Apache:

 sudo systemctl restart apache2

? 4. Use HTTPS with Strong TLS Settings

Never run Apache over HTTP in production.

• Get a free certificate from Let's Encrypt
• Force HTTPS with a redirect:

   <VirtualHost *:80>
    ServerName yourdomain.com
    Redirect permanent / https://yourdomain.com/
  </VirtualHost>

In your SSL virtual host, use strong ciphers:

 SSLEngine on
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder off

Tip: Test your SSL setup at SSL Labs

? 5. Restrict File and Directory Access

Use .htaccess or <Directory> blocks wisely.

Example (in your site config):

 <Directory /var/www/html>
    Options -Indexes # Prevent directory listing
    AllowOverride None # Disable .htaccess unless needed
    Require all granted
</Directory>

If you must allow .htaccess , ensure it's limited to specific directories and doesn't override critical security settings.

? 6. Set Proper File Permissions

Web files should be owned by a non-root user (eg, www-data ), and directories should not be writable by the web server unless necessary.

 sudo chown -R www-data:www-data /var/www/html
sudo find /var/www/html -type d -exec chmod 755 {} \;
sudo find /var/www/html -type f -exec chmod 644 {} \;

Avoid 777 permissions—ever.

? 7. Enable and Configure mod_security mod_evasive

• mod_security : A web application firewall (WAF) for Apache
• mod_evasive : Helps mitigate DoS/DDoS attacks

Install:

 sudo apt install libapache2-mod-security2 mod-evasive
sudo a2enmod security2 evasive

Configure basic rules in /etc/modsecurity/modsecurity.conf and set thresholds in /etc/apache2/mods-enabled/evasive.conf .

Start with conservative settings to avoid blocking legitimate traffic.

? 8. Log and Monitor Access

Enable logging and review logs regularly:

 LogLevel warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

Monitor with tools like:

• journalctl -u apache2 (systemd)
• logwatch or fail2ban for automated alerts

? Bonus: Run Apache in a Chroot or Container (Optional but Strong)

For high-security environments, isolate Apache using:

• systemd service with RootDirectory=
• Docker/Podman containers
• SELinux/AppArmor policies

This limits what Apache can access if compromised.

Final Tip : Test your setup with tools like:

• nmap --script http-security-headers yourdomain.com
• nikto -h yourdomain.com

Hardening Apache isn't a one-time task—it's ongoing. But these steps give you a solid baseline that blocks 90% of common attacks.

Basically, it's about reducing exposure, staying updated, and enforcing least privilege. Not glamorous—but effective.

The above is the detailed content of How to Secure Apache on a Linux Server. For more information, please follow other related articles on the PHP Chinese website!