Securing Your Web Server (Apache/Nginx)
Beyond a firewall, you should harden your web server's configuration.
General Tips
- Keep Software Updated: Always run the latest stable version of your web server and PHP.
- Disable Unused Modules: Reduce your attack surface by disabling any Apache or Nginx modules you don't need.
- Run as a Non-Privileged User: Ensure your web server runs under its own user account (e.g., `www-data`).
Hiding Version Information
It's good practice to hide your Apache or Nginx version to make it harder for attackers to find exploits.
For Nginx: Add `server_tokens off;` to your `/etc/nginx/nginx.conf` file's http block.
For Apache: Add `ServerTokens Prod` and `ServerSignature Off` to your `/etc/apache2/apache2.conf` file.
