Web server security

Web Server Security Audit Checklist: Nginx & Apache

Nginx and Apache - what they expose and how they are configured.

6
audits
Web Server
36
individual checks
named
~68s
to run the category
read-only

Your web server is the one process the entire internet is invited to talk to. Everything it exposes, it exposes to everyone: a stray directory listing, a forgotten .git folder, a version banner that tells a scanner which exploit to try.

  • Read-only, safe on production
  • No agent installed
  • ~68s for the category
  • 10 distros auto-detected

How much of this is serious?

Severity of all 36 Web Server checks, as the scripts rate them.

  • 8High severity22%
  • 18Medium severity50%
  • 10Low severity28%

What these audits cover

  • HSTS, CSP, framing, MIME sniffing, referrer and permissions policy headers
  • Protocol versions, cipher suites, certificate validity and HTTPS redirection
  • Directory listing, hidden files, stray backups, permitted methods and status endpoints
  • Version disclosure, worker privileges, request limits and log configuration

What they do not cover

  • Application vulnerabilities. These audits read server configuration, not the code behind it.
  • A live web application scan. Nothing here crawls your routes or submits forms.
  • CDN and WAF configuration. If Cloudflare terminates TLS, the headers a visitor sees may not be the ones this reads.
The catalog

The 6 Web Server audits

Security headers are the cheapest wins here and the most commonly missing: a handful of lines in a config file.

Security Headers

Soon

HSTS, CSP, framing, MIME sniffing, referrer and permissions policy

8 checks~10s

Configuration Hardening

Soon

File permissions, web root ownership, request limits and modules

6 checks~11s2 need root

Content Exposure

Soon

Directory listing, hidden files, backups, methods and status endpoints

6 checks~14s2 need root

TLS Configuration

Soon

Protocol versions, cipher suites, certificates and HTTPS redirection

6 checks~12s1 need root

Identification & Patching

Soon

Server inventory, version disclosure, worker privileges and pending updates

5 checks~9s1 need root

Logging & Monitoring

Soon

Access and error logging, log permissions, rotation and WAF presence

5 checks~12s2 need root
Keep going

Other categories

VPS & Server7 audits45 checksDatabase6 audits37 checksDocker6 audits39 checks
FAQ

Web Server security questions

A web server security audit reviews how Nginx or Apache is configured and what it returns to clients: which security headers are set, which TLS protocol versions and cipher suites are accepted, whether directory listing or hidden files are exposed, whether the server discloses its version, and whether access and error logging is configured and rotated.
At minimum: Strict-Transport-Security to force HTTPS, Content-Security-Policy to constrain what the page may load, X-Frame-Options or a CSP frame-ancestors directive to prevent clickjacking, X-Content-Type-Options set to nosniff, a Referrer-Policy, and a Permissions-Policy to switch off browser features the site does not use.
Yes. The audits detect which web server is installed and read the configuration layout for that server, so a host running Nginx is checked as Nginx and a host running Apache as Apache. A server running both is checked for both.
The configuration checks will, because they read the files on your origin. The response checks need more care: if a CDN terminates TLS and injects or strips headers, the headers a visitor receives are not necessarily the ones your origin sets. Audit the origin with these checks, then verify the edge separately.
On a fully patched server it matters much less, which is why it is a low-severity finding rather than a failure. Its practical cost is that it lets an automated scanner skip straight to the exploits that match your exact version, so removing the banner buys you nothing against a determined attacker and a great deal against opportunistic scanning.
Audit your fleet

Run all 36 Web Server checks, in one click

CtrlOps runs these audits over your existing SSH connection - no agents, no scripts to manage. $7/user/month after a 1 month free trial - no credit card required.

✓ Start instantly·✓ No credit card·✓ No sneaky autorenewals