Рекомендации по защите: Web-серверы. Linux

# Apache:
ServerTokens Prod
ServerSignature Off

# nginx:
server_tokens off;

httpd.conf (Apache):
##LoadModule dav_module modules/mod_dav.so
##LoadModule dav_fs_module modules/mod_dav_fs.so

## LoadModule autoindex_module modules/mod_autoindex.so

#nginx:  
nginx -V 2>&1|xargs -n1|grep module

#Apache: 
httpd –M / apachectl –M / apache2 –M / apache2ctl –M 
# в зависимости от ОС, подойдёт одна из перечисленных.

#nginx:
if ($request_method !~ ^(GET|HEAD|POST|PATCH)$ )
{
	return 444;
}

#Apache: 
TraceEnable off # В конфигурации сервера
 …
<LimitExcept GET POST PATCH OPTIONS>
Require all denied
</LimitExcept>

#Apache:
<VirtualHost www.yoursite.ru:80>
ServerName www.yoursite.ru
</VirtualHost>

#nginx:
server {
    server_name www.yoursite.ru;
 }
Также в некоторых случаях возможно использование редиректа, например:
<VirtualHost www.yoursite.ru:80>
Redirect permanent / www.yoursite.ru
</VirtualHost>

#Apache: 
Listen 10.10.10.10:80
Listen [2001:11d8:1311:0:a221:18:e416:cb11]:80

#nginx:
listen       10.10.10.10:80;

#Apache (httpd.conf):
Header always append X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options nosniff
Header set X-XSS-Protection "1; mode=block"

#nginx (nginx.conf):
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";

Content-Security-Policy: script-src www.google-analytics.com; img-src www.google-analytics.com

#Apache:
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

#nginx:
add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload';

#Apache:
ErrorLog /var/log/httpd/error_log
LogFormat "%h %l %u %t \"%r\" %>s %b" common
CustomLog logs/access_log common

#nginx:
access_log /var/log/yoursite_access.log;
error_log /var/log/yoursite_error.log error;