Apache2 Web Deployment: Securing Against Common Attacks

In the previous article, we discussed firewall configuration and security policies to establish a solid foundational security posture for your Apache2 server. However, relying solely on a firewall is insufficient to fully protect your web application. In this article, we’ll delve deeper into security hardening techniques—specific configurations that help prevent common web attacks and further strengthen your website’s security.

1. Preventing Directory Traversal Attacks

By default, Apache2 may inadvertently allow users to access directories that should not be publicly exposed. To prevent directory traversal attacks, add the following directive to your Apache configuration file:

<Directory />
    AllowOverride None
    Require all denied
</Directory>

This blocks access to all content under the filesystem root. To ensure only designated directories (e.g., /var/www/html) are accessible, explicitly grant permissions there:

<Directory /var/www/html>
    AllowOverride All
    Require all granted
</Directory>

2. Mitigating Cross-Site Scripting (XSS) Attacks

XSS attacks inject malicious scripts into web pages to steal data or manipulate user behavior. Apache can help mitigate these threats by setting appropriate HTTP response headers. Add the following lines either to your site’s .htaccess file or directly in the Apache configuration:

Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"

These headers enable built-in browser XSS protection and instruct browsers not to “sniff” MIME types—preventing unintended interpretation of content.

3. Mitigating SQL Injection

Although SQL injection vulnerabilities primarily stem from insecure backend code, Apache-level protections can serve as an additional defense layer. One effective tool is the mod_security module—a powerful web application firewall (WAF). First, install it:

sudo apt-get install libapache2-mod-security2

Then enable its core engine in your Apache configuration:

<IfModule mod_security2.c>
    SecRuleEngine On
</IfModule>

Finally, deploy rule sets (e.g., the OWASP Core Rule Set) to detect and block known SQL injection patterns.

4. Enabling SSL/TLS Encryption

To ensure confidentiality and integrity of data in transit, always use HTTPS via SSL/TLS. Verify that the ssl module is installed and enabled, and obtain a valid certificate—Let’s Encrypt offers free, trusted certificates.

Enable the SSL module:

sudo a2enmod ssl

Then configure an SSL-enabled virtual host:

<VirtualHost *:443>
    ServerName www.yourdomain.com
    DocumentRoot /var/www/html
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/yourdomain.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain.com/privkey.pem
</VirtualHost>

Remember to renew your Let’s Encrypt certificate periodically and redirect HTTP traffic to HTTPS to enforce secure connections.

5. Limiting Request Size and Rate

To defend against denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks, impose constraints on request size and frequency.

Limit the maximum allowed request body size (e.g., to 100 KB):

LimitRequestBody 102400

For rate limiting per IP address, use the mod_evasive module:

sudo apt-get install libapache2-mod-evasive

Configure it to throttle excessive requests:

<IfModule mod_evasive20.c>
    DOSHashTableSize 3097
    DOSPageCount 20
    DOSSiteCount 300
    DOSPageInterval 1
    DOSSiteInterval 1
    DOSEmailNotify youremail@example.com
</IfModule>

This setup triggers alerts and temporary IP bans when thresholds are exceeded.

6. Monitoring and Log Management

Robust monitoring and centralized logging are critical for detecting and responding to suspicious activity. Ensure Apache logs both access and errors comprehensively:

CustomLog ${APACHE_LOG_DIR}/access.log combined
ErrorLog ${APACHE_LOG_DIR}/error.log

Regularly review logs—especially for repeated failed logins, unusual user agents, or abnormal status codes—to identify potential intrusion attempts early.

Summary

The measures outlined above significantly enhance the security posture of your Apache2 server and reduce exposure to prevalent web-based threats. When combined with the firewall and network-level policies covered earlier, they form a layered, robust defense-in-depth strategy.

In the next article, we’ll recap key concepts from this entire tutorial series—reinforcing essential practices and ensuring you retain and confidently apply what you’ve learned.

We hope these security configurations prove valuable in your web deployment workflow. If you have questions or encounter issues, feel free to ask. Remember: security isn’t optional—it’s foundational.