Apache Security Hardening: The Complete Configuration Guide

Start by running a free ZeriFlow scan on your domain to establish a baseline security score. Then work through each section below and scan again at the end to confirm your improvements.

Hiding Server Information: ServerTokens and ServerSignature

By default, Apache includes its full version number and loaded modules in HTTP response headers and error pages. This is reconnaissance gold for attackers — they know exactly which version-specific vulnerabilities to attempt.

Add these directives to your main Apache configuration (usually /etc/apache2/apache2.conf or /etc/httpd/conf/httpd.conf):

• ServerTokens Prod: Reduces the Server header to Apache only, removing the version number and OS information.
• ServerSignature Off: Removes the server information footer from error pages and directory listings.

Disable directory listings:

This prevents Apache from generating a file browser when no index file exists in a directory — a common source of accidental information disclosure.

Disable unused modules: Apache ships with many modules enabled by default that you may not need. Run apache2ctl -M to list active modules and disable anything unused with a2dismod:

SSL/TLS Configuration: Enforcing Modern Protocols

Apache's default SSL configuration accepts protocols and ciphers that have known vulnerabilities. Here is a production-ready SSL configuration using mod_ssl:

HTTP to HTTPS redirect:

Security Headers via mod_headers

Apache's mod_headers module lets you add security headers to every response. Ensure the module is enabled first:

Then add these to your VirtualHost or to a global conf file:

The always keyword ensures headers are sent on all response codes, including 3xx, 4xx, and 5xx — not just 200 OK responses.

.htaccess Security Configuration

For shared hosting or situations where you cannot modify the main Apache configuration, .htaccess files provide a powerful alternative. Place this in your site's root directory:

Note: .htaccess is processed on every request, adding slight overhead. For performance-critical applications, apply these settings in httpd.conf or a VirtualHost block with AllowOverride None and move all rules to the main configuration.

Rate Limiting With mod_ratelimit and mod_evasive

Apache does not have built-in rate limiting as flexible as Nginx, but mod_evasive provides basic DDoS and brute-force protection:

Configuration in /etc/apache2/mods-available/evasive.conf:

This blocks any IP that requests the same page more than 5 times per second or makes more than 50 requests to the site per second, for 600 seconds.

Verify Everything With ZeriFlow

After completing these changes, run apachectl -t to verify there are no syntax errors, then restart Apache with systemctl restart apache2.

Run a ZeriFlow security scan on your domain to verify: - Security headers are present and correctly formatted - TLS protocol version and cipher strength - Server information disclosure has been eliminated - HTTPS redirect is working - HSTS header configuration

FAQ

### Q: Should I use .htaccess or VirtualHost for security headers? A: VirtualHost (or the main httpd.conf) is always preferred for performance. .htaccess is parsed on every request, while VirtualHost directives are loaded once at startup. Use .htaccess only when you do not have access to the main configuration files.

### Q: How do I check which Apache modules are currently loaded? A: Run apache2ctl -M (Ubuntu/Debian) or httpd -M (RHEL/CentOS). This lists all static and shared modules. Disable any module you do not actively use with a2dismod <module_name>.

### Q: Does ServerTokens Prod completely hide that I am running Apache? A: It hides the version, but the Server: Apache header still reveals the server software. Completely hiding this requires the mod_security module with a custom SecServerSignature directive, or a reverse proxy (like Cloudflare) in front of your server.

### Q: Can I use Let's Encrypt certificates with this Apache SSL configuration? A: Yes. Certbot automatically generates a compatible Apache SSL configuration when you run certbot --apache. Review the generated configuration against the snippet above to ensure strong protocols and ciphers are enforced — Certbot's defaults are good but occasionally conservative on older systems.

Conclusion

Apache security hardening is a systematic process. Start with information disclosure (ServerTokens, ServerSignature), move to TLS hardening, add security headers, and finish with rate limiting and access controls. Each layer adds protection that the previous layers cannot provide alone.

The configurations in this guide follow the Mozilla SSL Configuration guidelines and OWASP security header recommendations — the same standards used by major enterprises worldwide.

Scan your Apache server with ZeriFlow after applying these settings. The free scan runs 80+ security checks and gives you an objective score with specific, actionable findings for any remaining issues.

Further Reading

• RFC 6797 — HTTP Strict Transport Security (HSTS)
• Mozilla SSL Configuration Generator
• RFC 8996 — Deprecating TLS 1.0 and TLS 1.1

<!-- zf-internal-links -->