Web Server Security Guide (Nginx, Apache, Caddy, IIS) 🚀

1️⃣ General Web Server Security Best Practices

✅ Keep the Server Updated

• Regularly update your web server software (nginx, apache, caddy, or iis).
• Enable automatic security updates for Linux/Windows.

✅ Run as a Non-Root User

• Set up a dedicated user for running web services (www-data, nginx, httpd, etc.).
• Restrict permissions using chown and chmod.

✅ Use TLS/SSL (HTTPS)

• Always enable TLS 1.2+ (TLS 1.3 recommended).
• Get free certificates using Let’s Encrypt (Certbot, ACME.sh).
• Disable weak ciphers and older TLS versions.

✅ Disable Unnecessary Modules

• Remove unused modules to reduce attack surface:
  • Nginx: ngx_http_autoindex_module, ngx_http_ssi_module
  • Apache: mod_status, mod_autoindex, mod_info

✅ Limit Server Signature Exposure

• Hide software versions to prevent targeted attacks.
  • Apache: ServerTokens Prod and ServerSignature Off
  • Nginx: server_tokens off;

✅ Restrict File & Directory Access

• Block access to .htaccess, .env, phpinfo.php, etc.
• Use deny all; (Nginx) or Require all denied (Apache).

✅ Enable Rate Limiting

• Prevent brute-force attacks with fail2ban or server rate limits.

✅ Enable Web Application Firewall (WAF)

• Use ModSecurity (Apache/Nginx) or Cloudflare WAF.

✅ Enable Logging & Monitoring

• Store logs in /var/log/nginx/access.log or /var/log/apache2/access.log.
• Use GoAccess, ELK (Elasticsearch + Logstash + Kibana), or Grafana for analysis.

---

2️⃣ Nginx Hardening Guide 🛡️

🔹 Basic Security Configuration

Edit /etc/nginx/nginx.conf:

nginxserver_tokens off;
client_max_body_size 10M;
client_body_timeout 10s;
client_header_timeout 10s;
keepalive_timeout 15s;
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
limit_req_zone $binary_remote_addr zone=req_limit:10m rate=5r/s;

🔹 Enable SSL/TLS

Edit /etc/nginx/sites-available/default:

nginxserver {
    listen 443 ssl;
    server_name example.com;
    
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
}

💡 Use Let’s Encrypt to generate a certificate:

bash
sudo certbot --nginx -d example.com

🔹 Prevent DoS & Slowloris Attacks

nginxlimit_req_zone $binary_remote_addr zone=one:10m rate=30r/m;
server {
    location / {
        limit_req zone=one burst=10 nodelay;
    }
}

---

3️⃣ Apache Hardening Guide 🛡️

🔹 Basic Security Configuration

Edit /etc/apache2/apache2.conf:

apacheServerTokens Prod
ServerSignature Off
TraceEnable Off
Timeout 30
FileETag None

🔹 Enable SSL/TLS

Edit /etc/apache2/sites-available/default-ssl.conf:

apache<VirtualHost *:443>
    ServerName example.com
    
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

    SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite HIGH:!aNULL:!MD5
</VirtualHost>

💡 Use Let’s Encrypt to generate a certificate:

bash
sudo certbot --apache -d example.com

🔹 Block Bad Bots & User Agents

Create /etc/apache2/conf-available/security.conf:

apache<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP_USER_AGENT} ^.*(curl|wget|python|scrapy|nmap).*$ [NC,OR]
    RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) [NC]
    RewriteRule .* - [F,L]
</IfModule>

Enable the security module:

bash
sudo a2enmod rewrite
sudo systemctl restart apache2

---

4️⃣ Caddy Hardening Guide 🛡️

🔹 Basic Security Configuration

Edit Caddyfile:

caddyexample.com {
    root * /var/www/html
    file_server

    tls {
        protocols tls1.2 tls1.3
        ciphers X25519:CHACHA20-POLY1305:AES256-GCM-SHA384
    }
    
    header {
        Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Referrer-Policy "strict-origin"
    }

    log {
        output file /var/log/caddy/access.log
    }
}

🔹 Enable Automatic SSL

bash

caddy run

Caddy automatically obtains and renews SSL certificates. 🚀

---

5️⃣ IIS Hardening Guide 🛡️

🔹 Disable Unused Features

• Open IIS Manager → “Manage Optional Features”
• Disable WebDAV, FTP, CGI, and Unused Modules

🔹 Enable TLS 1.2+

Run the following PowerShell script:

powershell

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Name Enabled -Value 0
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -Name Enabled -Value 0
Restart-Service w3svc

🔹 Enable Logging

• Go to IIS Manager → Logging → Enable Logs
• Store logs in D:\IIS_Logs (avoid C:\Windows\System32\).

---

🚀 Summary: Secure Your Web Server

✔ Harden configuration (disable weak protocols, limit access).
✔ Use TLS 1.2+ with strong ciphers.
✔ Implement WAF & rate limiting to stop attacks.
✔ Hide server headers & block bad bots.
✔ Enable logging & monitoring for security events.