Web Server Hardening

# nginx.conf
http {
    server_tokens off;          # Removes version from Server header and error pages
                                # Server: nginx  (instead of Server: nginx/1.25.3)
}

# httpd.conf or security.conf
ServerTokens Prod               # Server: Apache  (suppresses OS, module, version)
ServerSignature Off             # Removes server info from error pages

# Remove Server header entirely (IIS 10+)
Import-Module WebAdministration
Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' `
  -filter 'system.webServer/security/requestFiltering' `
  -name 'removeServerHeader' -value 'True'

# Remove X-Powered-By header (PHP, ASP.NET reveal themselves here)
fastcgi_hide_header X-Powered-By;
proxy_hide_header X-Powered-By;

# Apache — requires mod_headers
Header unset X-Powered-By
Header always unset X-Powered-By

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    ssl_certificate     /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;

    # Protocols — TLS 1.2 minimum; TLS 1.3 preferred
    ssl_protocols TLSv1.2 TLSv1.3;

    # Cipher suites — forward secrecy, authenticated encryption only
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
    ssl_prefer_server_ciphers off;    # Let TLS 1.3 clients negotiate freely

    # Session resumption — performance + security balance
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;          # Disable tickets; forward secrecy degrades with long-lived ticket keys

    # OCSP stapling
    ssl_stapling        on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/ssl/certs/ca-bundle.crt;
    resolver            1.1.1.1 8.8.8.8 valid=300s;
    resolver_timeout    5s;

    # Diffie-Hellman parameters (for DHE cipher suites)
    ssl_dhparam /etc/ssl/dhparam.pem;   # Generate: openssl dhparam -out /etc/ssl/dhparam.pem 3072
}

SSLEngine on
SSLCertificateFile      /etc/ssl/certs/example.com.crt
SSLCertificateKeyFile   /etc/ssl/private/example.com.key
SSLCACertificateFile    /etc/ssl/certs/ca-bundle.crt

SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder     off
SSLSessionTickets       off

SSLUseStapling          on
SSLStaplingCache        shmcb:/run/apache2/ssl_stapling(32768)
SSLStaplingStandardCacheTimeout 3600

# Nginx — redirect HTTP to HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

# Apache
<VirtualHost *:80>
    RewriteEngine On
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</VirtualHost>

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

add_header X-Content-Type-Options "nosniff" always;

add_header X-Frame-Options "DENY" always;
# Or SAMEORIGIN if your application legitimately iframes itself

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

add_header Permissions-Policy "
  accelerometer=(),
  camera=(),
  geolocation=(),
  gyroscope=(),
  magnetometer=(),
  microphone=(),
  payment=(),
  usb=()
" always;

add_header Content-Security-Policy "
  default-src 'self';
  script-src 'self' https://www.google-analytics.com https://js.stripe.com;
  style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
  font-src 'self' https://fonts.gstatic.com;
  img-src 'self' data: https:;
  connect-src 'self' https://api.example.com https://www.google-analytics.com;
  frame-src https://js.stripe.com;
  object-src 'none';
  base-uri 'self';
  form-action 'self';
  upgrade-insecure-requests;
  report-uri https://csp-report.example.com/collect;
" always;

# Phase 1: Report-only — no blocking, collect violations
add_header Content-Security-Policy-Report-Only "default-src 'self'; report-uri /csp-report;" always;

# Phase 2: Once violations are clean, switch to enforcing
add_header Content-Security-Policy "default-src 'self'; ..." always;

# Nginx with nonce — requires server-side generation
# In application code, generate a cryptographically random nonce per request:
# nonce = base64(os.urandom(16))
# Inject into both the CSP header and the <script> tag

# Header:
add_header Content-Security-Policy "script-src 'self' 'nonce-$request_id';" always;

# Template:
# <script nonce="{{nonce}}">...</script>

# Prevent cross-origin reads of your resources
add_header Cross-Origin-Resource-Policy "same-origin" always;

# Isolate your browsing context — required for SharedArrayBuffer, precise timers
add_header Cross-Origin-Opener-Policy "same-origin" always;

# Require CORP on all sub-resources (enables full cross-origin isolation)
add_header Cross-Origin-Embedder-Policy "require-corp" always;

# Place in http {} or server {} block
add_header Strict-Transport-Security  "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options     "nosniff"                                       always;
add_header X-Frame-Options            "DENY"                                          always;
add_header Referrer-Policy            "strict-origin-when-cross-origin"               always;
add_header Permissions-Policy         "accelerometer=(), camera=(), geolocation=(), microphone=(), payment=(), usb=()" always;
add_header Content-Security-Policy    "default-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests;" always;
add_header Cross-Origin-Resource-Policy "same-origin"                                 always;

# Nginx — allowlist GET, POST, HEAD only
location / {
    limit_except GET POST HEAD {
        deny all;
    }
}

# Apache — block TRACE and OPTIONS globally
<LimitExcept GET POST HEAD>
    Order deny,allow
    Deny from all
</LimitExcept>

# Explicitly disable TRACE
TraceEnable Off

# Verify TRACE is disabled
curl -X TRACE https://example.com -I
# Should return: 405 Method Not Allowed

# Nginx — directory listing is off by default; confirm it
autoindex off;

# Apache — disable directory listing
Options -Indexes -FollowSymLinks

# Also disable .htaccess override in production for performance + security
AllowOverride None

# Nginx
location ~* /\.(git|env|svn|htaccess|htpasswd|DS_Store) {
    deny all;
    return 404;
}

location ~* \.(bak|backup|sql|log|conf|config|ini|old|orig|save|swp|tmp)$ {
    deny all;
    return 404;
}

# Apache
<FilesMatch "(\.env|\.git|\.htaccess|\.htpasswd|\.log|\.bak|\.sql|\.conf|\.ini|\.swp|\.old)$">
    Require all denied
</FilesMatch>

http {
    # Limit request body size (adjust for legitimate file upload needs)
    client_max_body_size        10m;

    # Limit header size
    large_client_header_buffers 4 16k;
    client_header_buffer_size   1k;

    # Timeouts — protect against Slowloris and slow-read attacks
    client_body_timeout         12s;    # Time to receive the request body
    client_header_timeout       12s;    # Time to receive the request headers
    keepalive_timeout           15s;    # Keep-alive connection timeout
    send_timeout                10s;    # Time between two successive writes to client
}

# mod_reqtimeout — protect against Slowloris
<IfModule mod_reqtimeout.c>
    RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500
</IfModule>

# Limit request size
LimitRequestBody    10485760    # 10 MB
LimitRequestFields  100
LimitRequestFieldSize 8190
LimitRequestLine    8190

# Timeouts
Timeout             60
KeepAliveTimeout    5
MaxKeepAliveRequests 100

http {
    # Define rate limit zones
    limit_req_zone $binary_remote_addr zone=global:10m    rate=30r/s;
    limit_req_zone $binary_remote_addr zone=login:10m     rate=5r/m;
    limit_req_zone $binary_remote_addr zone=api:10m       rate=60r/m;

    server {
        # Apply global rate limit with burst allowance
        limit_req zone=global burst=50 nodelay;

        # Stricter limit on authentication endpoints
        location ~* ^/(login|signin|auth|token|password) {
            limit_req zone=login burst=3 nodelay;
            limit_req_status 429;
            # ...
        }

        # API rate limit
        location /api/ {
            limit_req zone=api burst=20 nodelay;
            limit_req_status 429;
        }
    }
}

# Apache — mod_ratelimit (less granular than Nginx)
<Location "/login">
    SetOutputFilter RATE_LIMIT
    SetEnv rate-limit 400   # KB/s — limits response rate, not request rate
</Location>

# For request-level rate limiting in Apache, use mod_evasive:
<IfModule mod_evasive24.c>
    DOSHashTableSize    3097
    DOSPageCount        5
    DOSSiteCount        50
    DOSPageInterval     1
    DOSSiteInterval     1
    DOSBlockingPeriod   10
</IfModule>

# Nginx — custom error pages
error_page 400 401 403 404     /errors/4xx.html;
error_page 500 502 503 504     /errors/5xx.html;

location ^~ /errors/ {
    internal;   # Only accessible via internal redirects, not directly
    root /var/www;
}

# Apache
ErrorDocument 400 /errors/400.html
ErrorDocument 403 /errors/403.html
ErrorDocument 404 /errors/404.html
ErrorDocument 500 /errors/500.html

http {
    log_format json_combined escape=json
        '{'
            '"time":"$time_iso8601",'
            '"remote_addr":"$remote_addr",'
            '"method":"$request_method",'
            '"uri":"$uri",'
            '"status":$status,'
            '"body_bytes_sent":$body_bytes_sent,'
            '"request_time":$request_time,'
            '"http_referer":"$http_referer",'
            '"http_user_agent":"$http_user_agent",'
            '"http_x_forwarded_for":"$http_x_forwarded_for",'
            '"ssl_protocol":"$ssl_protocol",'
            '"ssl_cipher":"$ssl_cipher"'
        '}';

    access_log /var/log/nginx/access.log json_combined;
    error_log  /var/log/nginx/error.log  warn;
}

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %T" combined_plus
CustomLog /var/log/apache2/access.log combined_plus
ErrorLog  /var/log/apache2/error.log
LogLevel  warn

# Enable HTTP/2 for performance and security (requires TLS)
listen 443 ssl http2;

# Keep-Alive — balance resource use against performance
keepalive_timeout  65;
keepalive_requests 1000;

# Disable modules (Debian/Ubuntu)
a2dismod status        # Server status page — disable on production
a2dismod info          # Server info page — disable on production
a2dismod userdir       # User home directory access
a2dismod autoindex     # Directory listing
a2dismod cgi           # CGI execution — disable unless needed

# Confirm loaded modules
apache2 -M

location /nginx_status {
    stub_status;
    allow 127.0.0.1;
    deny all;
}

# Nginx / Apache should run as an unprivileged user, not root
# Nginx default: www-data or nginx
ps aux | grep nginx

# Ensure web root is not writable by the web server process
chown -R root:www-data /var/www/html
chmod -R 750 /var/www/html

# Web server should not have write access to its own config
chmod 644 /etc/nginx/nginx.conf
chown root:root /etc/nginx/nginx.conf

# Consider running in a chroot or container for additional isolation

# Nginx — if only serving on one interface
server {
    listen 192.0.2.1:443 ssl http2;   # Specific IP, not 0.0.0.0
}