Apache · Configuration and operations
How do you harden an Apache server?
Short answer
Reduce information disclosure, load only necessary modules, disable risky features, enforce TLS and least privilege, and put authentication and network controls in front of administrative surfaces.
Hardening is layered. The server should reveal as little as possible, run with minimal privileges, expose only required functionality and log enough to detect abuse. Most incidents come from known weaknesses in optional features rather than the core HTTP parser.
ServerTokens Prod
ServerSignature Off
TraceEnable Off
<Directory "/var/www">
Options -Indexes -ExecCGI -Includes
AllowOverride None
Require all granted
</Directory>
<DirectoryMatch "/[.]git">
Require all denied
</DirectoryMatch>
<FilesMatch "(^[.]env$|^[.]htpasswd$|^[.]git$)">
Require all denied
</FilesMatch>
LimitRequestBody 10485760
<Location "/server-status">
Require ip 127.0.0.1
</Location>Hardening checklist
- Patch Apache and modules promptly; track CVEs for every loaded module
- Load only the modules the site uses and remove default sample content
- Run as an unprivileged user and keep configuration and keys root-owned
- Disable directory listing, CGI and server-side includes where not needed
- Protect status, balancer-manager and other administrative handlers
- Enforce TLS 1.2 and 1.3, redirect HTTP and add security headers
- Set request body limits and timeouts to reduce abuse
- Isolate tenants and applications with separate users or containers
- Ship logs to a central system and alert on repeated 403 and 401 patterns
Never expose .git, environment files, backups or database dumps. Deny them explicitly and keep them outside the document root in the first place. Writable .htaccess or upload directories that can execute code are a common path to compromise.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1Which default Apache features would you disable?
- 2Why is running as root dangerous for a web server?
- 3How do you protect server-status?
- 4What would you check after a suspected compromise?
Say it in the interview
I reduce exposure first: minimal modules, no directory listing, no sample content, protected admin handlers and explicit denial of sensitive files. I enforce TLS, request limits and least privilege, and I patch the whole module stack. Then I centralize logs and alert on auth failures. Banner changes alone are not a security control, so I do not treat them as one.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Apache mock interview and get scored feedback on depth, clarity and confidence.