Hardening Apache HTTP Server

Remove server version banner

The default configuration will expose Apache Version and OS type, to prevent it change the ServerTokens to Prod and ServerSignature to Off in the Apache configuration file /etc/apache2/apache2.conf.

sudo nano /etc/apache2/apache2.conf
ServerTokens Prod
ServerSignature Off

curl --head https://technicalnode.ddns.net
HTTP/1.0 500 Only GET and POST are supported
Date: Tue, 14 Jul 2026 01:05:48 GMT
Server: Apache
Set-Cookie: PHPSESSID=fq5ah1kg03f0p391lrooi04cpt; path=/; SameSite=strict
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8

Enable HTTP Strict Transport Security (HSTS) for Apache

sudo a2enmod headers

nano /etc/apache2/sites-available/000-default-ssl.conf
<VirtualHost *:443>
        Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</VirtualHost>

Enable HTTP/2

sudo apt install php8.3-fpm
sudo a2enconf php8.3-fpm
sudo a2dismod mpm_prefork
sudo a2enmod mpm_event
sudo a2enmod http2
/etc/apache2/mods-available/http2.conf
Protocols h2 h2c http/1.1