Web server security

Nginx and Apache Security Audit Fixes

These are the fixes for a web server security audit: what your TLS configuration accepts, which headers the browser receives, what the server will serve that it should not, and how much it reveals about itself.

36
checks documented
6
audits in this category
8
need root or sudo
8
rated high severity

What these fixes cover

  • TLS protocol versions, cipher suites, certificate expiry and the HTTP to HTTPS redirect
  • HSTS, CSP, frame protection, CORS, referrer and permissions policy, and cookie flags
  • Directory listing, dotfiles, backup files, status endpoints and default welcome pages
  • Worker process user, version disclosure, request limits, rate limiting and log handling

What they do not

  • Your application code. A perfect header set does not fix an injection flaw behind it.
  • Headers added at a CDN or WAF edge. The probe runs from loopback, so edge-added headers are invisible and report as missing.
  • Routes other than the site root. Only the first server_name and the path / are examined.

How much of this is serious?

Severity of all 36 Web Server checks, as the scripts rate them.

  • 8High severity22%
  • 18Medium severity50%
  • 10Low severity28%
By audit

6 audits, 36 checks

Grouped by the 6 audits they belong to. TLS and content exposure come first: one governs whether traffic can be read, the other whether files can be fetched that were never meant to be public.

Keep going

The other three platforms

Most hosts run more than one of these. The split shows how much of each platform the audit rates as high severity.

FAQ

Web Server fix questions

This is the most common false positive in the section, and it has one cause: the probe runs against 127.0.0.1 from the server itself, so any header your CDN or WAF adds at the edge is invisible to it. It also only examines the root path of the first server_name. Confirm from outside with curl -I against your real hostname before changing anything.
Both. Every fix gives the Nginx directive and the Apache equivalent, because the audit detects whichever is installed. Caddy and lighttpd are detected as present but not configured by these fixes.
Content-Security-Policy will if you deploy a strict policy without testing, and HSTS is effectively irreversible for the duration of its max-age. Both pages cover the safe rollout: CSP in report-only mode first, HSTS with a short max-age before committing to a long one. The other headers are additive and safe.
When run as root the audit reads the fully resolved configuration (nginx -T), which follows every include. Without root it concatenates the main config, conf.d and sites-enabled instead, and can miss an include from elsewhere. It also never evaluates a config you have edited but not reloaded.
Audit your fleet

Run all 36 Web Server checks, in one click

CtrlOps runs these audits over your existing SSH connection - no agents, no scripts to manage. $7/user/month after a 1 month free trial - no credit card required.

✓ Start instantly·✓ No credit card·✓ No sneaky autorenewals