Security Best Practices in Apache
From the Apache cheat sheet · Security & Access Control · verified Jul 2026
Security Best Practices
Essential security configurations
apache
# Hide Apache version
ServerTokens Prod
ServerSignature Off
# Disable directory listing
Options -Indexes
# Prevent clickjacking
Header always append X-Frame-Options SAMEORIGIN
# Block access to sensitive files
<FilesMatch "^\.(htaccess|htpasswd|ini|log|sh)">
Order allow,deny
Deny from all
</FilesMatch>🔒 Hide version info and disable directory listing
🛡️ Use security headers to prevent attacks
⚠️ Implement ModSecurity for WAF protection
🔐 Use fail2ban to block attackers