Comprehensive Guide for Setting Up Apache Web Server on Linux

Enable on Debian/Ubuntu

sudo a2enmod rewrite
sudo a2ensite example-http
sudo apachectl -t && sudo systemctl reload apache2

Debian/Ubuntu

# Install PHP-FPM (specify version - 8.1, 8.2, 8.3, etc.)
sudo apt update
sudo apt install -y php8.3-fpm

# Enable required Apache modules
sudo a2enmod proxy proxy_fcgi setenvif
sudo a2dismod mpm_prefork  # Disable prefork if using mod_php
sudo a2enmod mpm_event     # Enable event MPM for better performance

# Create PHP-FPM configuration
sudo tee /etc/apache2/conf-available/php8.3-fpm.conf >/dev/null <<'EOF'
# Handle PHP files via PHP-FPM
<FilesMatch "\.php$">
    SetHandler "proxy:unix:/run/php/php8.3-fpm.sock|fcgi://localhost/"
</FilesMatch>

# Directory index preferences
DirectoryIndex index.php index.html

# Security: Prevent direct access to sensitive files
<Files "\.(env|ini|log|sh|sql|tpl|twig|yml)$">
    Require all denied
</Files>
EOF

# Enable PHP-FPM configuration
sudo a2enconf php8.3-fpm

# Start and enable PHP-FPM service
sudo systemctl enable php8.3-fpm
sudo systemctl start php8.3-fpm

# Test configuration and restart Apache
sudo apachectl -t && sudo systemctl restart apache2

RHEL 8/9, AlmaLinux, Rocky, CentOS Stream, Fedora

# Install PHP-FPM
sudo dnf install -y php-fpm

# Enable required modules (ensure these are uncommented in httpd.conf)
# LoadModule proxy_module modules/mod_proxy.so
# LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so

# Enable and start PHP-FPM service
sudo systemctl enable php-fpm
sudo systemctl start php-fpm

# Configure Apache to use PHP-FPM (add to /etc/httpd/conf.d/php-fpm.conf)
sudo tee /etc/httpd/conf.d/php-fpm.conf >/dev/null <<'EOF'
# Handle PHP files via PHP-FPM
<FilesMatch "\.php$">
    SetHandler "proxy:unix:/run/php-fpm/www.sock|fcgi://localhost/"
</FilesMatch>

# Directory index preferences
DirectoryIndex index.php index.html

# Security: Prevent direct access to sensitive files
<Files "\.(env|ini|log|sh|sql|tpl|twig|yml)$">
    Require all denied
</Files>
EOF

# Test configuration and restart Apache
sudo apachectl -t && sudo systemctl restart httpd

openSUSE Leap/Tumbleweed

# Install PHP-FPM
sudo zypper install -y php8-fpm

# Enable and start PHP-FPM service
sudo systemctl enable php8-fpm
sudo systemctl start php8-fpm

# Configure Apache (add to /etc/apache2/conf.d/php-fpm.conf)
sudo tee /etc/apache2/conf.d/php-fpm.conf >/dev/null <<'EOF'
# Handle PHP files via PHP-FPM
<FilesMatch "\.php$">
    SetHandler "proxy:unix:/run/php8-fpm.sock|fcgi://localhost/"
</FilesMatch>

DirectoryIndex index.php index.html
EOF

# Enable required modules
sudo a2enmod proxy
sudo a2enmod proxy_fcgi

# Test configuration and restart Apache
sudo apachectl -t && sudo systemctl restart apache2

Arch Linux

# Install PHP-FPM
sudo pacman -Syu --noconfirm php php-fpm

# Enable and start PHP-FPM service
sudo systemctl enable php-fpm
sudo systemctl start php-fpm

# Configure Apache (add to /etc/httpd/conf/extra/php-fpm.conf)
sudo tee /etc/httpd/conf/extra/php-fpm.conf >/dev/null <<'EOF'
# Handle PHP files via PHP-FPM
<FilesMatch "\.php$">
    SetHandler "proxy:unix:/run/php-fpm/php-fpm.sock|fcgi://localhost/"
</FilesMatch>

DirectoryIndex index.php index.html
EOF

# Include the configuration in httpd.conf
echo "Include conf/extra/php-fpm.conf" | sudo tee -a /etc/httpd/conf/httpd.conf

# Test configuration and restart Apache
sudo apachectl -t && sudo systemctl restart httpd

SELinux (RHEL/Fedora/CentOS)

# Check SELinux status
sudo sestatus

# Allow Apache to connect to network and sockets
sudo setsebool -P httpd_can_network_connect on
sudo setsebool -P httpd_execmem on
sudo setsebool -P httpd_unified on

# Label custom ports if using TCP instead of sockets
sudo semanage port -a -t http_port_t -p tcp 9000

# Check for denials and troubleshoot
sudo ausearch -m avc -ts recent
sudo sealert -a /var/log/audit/audit.log

AppArmor (Ubuntu/Debian)

# Check AppArmor status
sudo aa-status

# If using custom socket paths or experiencing permission issues:
sudo aa-complain apache2  # Temporarily put in complain mode
# Test your configuration, then re-enforce:
sudo aa-enforce apache2

# View and modify Apache AppArmor profile if needed
sudo cat /etc/apparmor.d/usr.sbin.apache2

Pool Configuration Locations

• Debian/Ubuntu: /etc/php/8.3/fpm/pool.d/www.conf
• RHEL/Fedora/CentOS: /etc/php-fpm.d/www.conf
• openSUSE: /etc/php8/fpm/pool.d/www.conf
• Arch Linux: /etc/php/php-fpm.d/www.conf

Optimized Pool Settings

; Process manager settings
pm = dynamic
; Maximum number of child processes
pm.max_children = 30
; Number of child processes created on startup
pm.start_servers = 4
; Minimum number of idle server processes
pm.min_spare_servers = 2
; Maximum number of idle server processes
pm.max_spare_servers = 8
; Maximum requests per child before respawn
pm.max_requests = 500

; Use Unix socket for better performance
listen = /run/php/php8.3-fpm.sock
; Socket permissions
listen.owner = www-data
listen.group = www-data
listen.mode = 0660

; Security and performance
; Prevent slow requests from blocking the pool
request_terminate_timeout = 60s
request_slowlog_timeout = 30s

; Process ownership
user = www-data
group = www-data

; Process priority (lower number = higher priority)
process.priority = -10

Verification and Troubleshooting

# 1. Check PHP-FPM service status
sudo systemctl status php8.3-fpm    # Debian/Ubuntu
sudo systemctl status php-fpm       # RHEL/Fedora

# 2. Verify socket file exists and has correct permissions
ls -la /run/php/php8.3-fpm.sock     # Debian/Ubuntu
ls -la /run/php-fpm/www.sock        # RHEL/Fedora

# 3. Test PHP processing with a simple script
sudo tee /var/www/html/phpinfo.php >/dev/null <<'EOF'
<?php
header('Content-Type: text/plain');
echo "PHP is working via FPM\n";
echo "Server: " . $_SERVER['SERVER_SOFTWARE'] . "\n";
echo "PHP Version: " . phpversion() . "\n";
?>
EOF

# 4. Test the PHP script
curl http://localhost/phpinfo.php

# 5. Check Apache error logs for PHP-FPM issues
sudo tail -f /var/log/apache2/error.log
sudo tail -f /var/log/httpd/error_log

# 6. Check PHP-FPM logs
sudo tail -f /var/log/php8.3-fpm.log    # Debian/Ubuntu
sudo tail -f /var/log/php-fpm/www-error.log  # RHEL/Fedora

# 7. Remove test file after verification
sudo rm /var/www/html/phpinfo.php

# Monitor PHP-FPM processes
sudo ps aux | grep php-fpm
sudo systemctl status php8.3-fpm

# Check PHP-FPM pool status (enable status page in pool config)
# Add to www.conf: pm.status_path = /status
curl http://localhost/status?full

# Monitor Apache and PHP-FPM resource usage
sudo htop
sudo apt install atop && sudo atop  # More detailed monitoring

# Check for slow PHP requests
sudo tail -f /var/log/php8.3-fpm-slow.log

Debian/Ubuntu

# Enable core proxy modules
sudo a2enmod proxy proxy_http proxy_balancer lbmethod_byrequests headers
sudo a2enmod proxy_hcheck    # Health checks
sudo a2enmod proxy_wstunnel  # WebSocket support
sudo a2enmod slotmem_shm     # Required for balancer
sudo a2enmod remoteip        # Client IP forwarding

# Test configuration and reload
sudo apachectl -t && sudo systemctl reload apache2

RHEL/Fedora/CentOS

# Ensure these modules are loaded in /etc/httpd/conf.modules.d/00-proxy.conf
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
LoadModule headers_module modules/mod_headers.so
LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so
LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
LoadModule remoteip_module modules/mod_remoteip.so

# Restart Apache to load modules
sudo systemctl restart httpd

Path-Based Routing Example

# Proxy specific paths to different backends
ProxyPass "/api/" "http://127.0.0.1:3000/"
ProxyPassReverse "/api/" "http://127.0.0.1:3000/"

ProxyPass "/app/" "http://127.0.0.1:8080/"
ProxyPassReverse "/app/" "http://127.0.0.1:8080/"

# Exclude static assets from proxying
ProxyPass "/static/" "!"
Alias "/static/" "/var/www/static/"

Basic Load Balancer

# Define balancer cluster with health checks
<Proxy "balancer://appcluster">
  BalancerMember "http://10.0.0.11:8080" route=1
  BalancerMember "http://10.0.0.12:8080" route=2
  BalancerMember "http://10.0.0.13:8080" route=3 status=+H
  ProxySet lbmethod=byrequests
</Proxy>

# Use the balancer
ProxyPass "/" "balancer://appcluster/"
ProxyPassReverse "/" "balancer://appcluster/"

Advanced Health Checks with mod_proxy_hcheck

# Health check configuration
<Proxy "balancer://webapp">
  BalancerMember "http://10.0.0.11:8080" hcheck=on hcinterval=10 hcpref=pass1
  BalancerMember "http://10.0.0.12:8080" hcheck=on hcinterval=10 hcpref=pass2

  # Health check settings
  ProxyHCExpr ok234 {%{REQUEST_STATUS} =~ /^[234]/}
  ProxyHCExpr ok200 {%{REQUEST_STATUS} == 200}

  # Health check for member 1
  ProxyHCExpr pass1 %{REQUEST_STATUS} == 200
  # Health check for member 2 - check specific health endpoint
  ProxyHCExpr pass2 %{REQUEST_STATUS} == 200
</Proxy>

# Alternative: Simple health check configuration
<Proxy "balancer://simpleapp">
  BalancerMember "http://10.0.0.11:8080" hcheck=on hcmethod=GET hcuri=/health hcinterval=30
  BalancerMember "http://10.0.0.12:8080" hcheck=on hcmethod=GET hcuri=/health hcinterval=30
  ProxySet hcmethod=GET hcuri=/health hcinterval=30
</Proxy>

ProxyPass "/" "balancer://webapp/"
ProxyPassReverse "/" "balancer://webapp/"

Balancer Manager for Monitoring

# Enable balancer manager for monitoring (restrict access!)
<Location "/balancer-manager">
  SetHandler balancer-manager
  Require ip 10.0.0.0/8
  Require local
</Location>

mod_remoteip Configuration

# Load module (if not already loaded)
LoadModule remoteip_module modules/mod_remoteip.so

# Configure trusted proxies (load balancers, CDNs, etc.)
RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy 10.0.0.0/8
RemoteIPInternalProxy 172.16.0.0/12
RemoteIPInternalProxy 192.168.0.0/16
RemoteIPTrustedProxy 203.0.113.45  # Your load balancer IP
RemoteIPTrustedProxy 2001:db8::1   # IPv6 example

# Update log format to use client IP
LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

Forwarded Headers Configuration

# Preserve original client information
RequestHeader set X-Forwarded-Proto "https" env=HTTPS
RequestHeader set X-Forwarded-Host "%{HTTP_HOST}s"
Note: %{...}s pulls server/request vars via mod_headers format string. Prefer X-Forwarded-Proto and X-Forwarded-For for scheme and client IP in apps.
RequestHeader set X-Forwarded-Server "%{SERVER_NAME}s"
RequestHeader set X-Real-IP "%{REMOTE_ADDR}s"

# Trust client IPs only from defined proxies via mod_remoteip (see config above)
# Do not unset X-Forwarded-For or X-Real-IP here.

Timeout Configuration

# Global proxy timeout settings
ProxyTimeout 300

# Per-route timeout configuration
ProxyPass "/api/" "http://127.0.0.1:3000/" timeout=300 retry=0
ProxyPass "/app/" "http://127.0.0.1:8080/" timeout=60 retry=3

# Connection pool settings
ProxyPass "/" "http://127.0.0.1:8080/" retry=0 timeout=60 connectiontimeout=5

# Buffer and packet settings
ProxyIOBufferSize 65536

WebSocket Proxy Configuration

# WebSocket proxy with proper headers
ProxyPass "/ws/" "ws://127.0.0.1:9000/"
ProxyPassReverse "/ws/" "ws://127.0.0.1:9000/"

# Alternative: Rewrite for WebSocket upgrade
RewriteEngine On
RewriteCond %{HTTP:Upgrade} websocket [NC]
RewriteCond %{HTTP:Connection} upgrade [NC]
RewriteRule "^/ws/(.*)" "ws://127.0.0.1:9000/$1" [P,L]

# Set WebSocket specific headers
RequestHeader set Upgrade "websocket"
RequestHeader set Connection "Upgrade"

Proxy Security Headers

# Critical security settings
ProxyRequests Off  # Prevent open proxy
ProxyVia Off       # Don't add Via header

# For reverse proxying, a <Proxy> block is not required. Do NOT enable a forward proxy.
# If you intentionally run a forward proxy, lock it down by IP:
# <Proxy "*">
#   Require ip 10.0.0.0/8
# </Proxy>

# Headers security
Header always unset X-Powered-By

Cookie and Domain Rewriting

# Fix cookie domains and paths
ProxyPassReverseCookieDomain internal.local example.com
ProxyPassReverseCookiePath / /app/

# Additional response header rewriting
ProxyPassReverse "http://127.0.0.1:8080/" "https://example.com/"
ProxyPassReverse "http://backend.internal/" "https://example.com/"

Verification Commands

# Test configuration
sudo apachectl configtest

# Check loaded modules
sudo apachectl -M | grep proxy

# Test backend connectivity
curl -I http://127.0.0.1:8080/health

# Monitor balancer status
curl http://localhost/balancer-manager

# Check headers are being forwarded
curl -H "X-Forwarded-For: 1.2.3.4" http://example.com/

# Debug logging (add to VirtualHost)
LogLevel proxy:trace5

Common Issues and Solutions

Enable event MPM

# Debian/Ubuntu
sudo a2dismod mpm_prefork
sudo a2enmod mpm_event
sudo systemctl restart apache2

# RHEL-based: Ensure this line in /etc/httpd/conf.modules.d/00-mpm.conf
LoadModule mpm_event_module modules/mod_mpm_event.so

Memory-Based MPM Tuning

Configure MPM settings based on your available memory and expected traffic:

<IfModule mpm_event_module>
StartServers             2
MinSpareThreads          25
MaxSpareThreads          75
ThreadsPerChild          25
MaxRequestWorkers        150
MaxConnectionsPerChild   0
</IfModule>

Enable Required Modules

# Debian/Ubuntu
sudo a2enmod headers
sudo a2enmod rewrite
sudo systemctl reload apache2

# RHEL/Fedora - Ensure these are loaded in httpd.conf
# LoadModule headers_module modules/mod_headers.so
# LoadModule rewrite_module modules/mod_rewrite.so

Basic Security Headers (Safe for Most Sites)

Start with these headers that won't break functionality:

# /etc/apache2/conf-available/security-headers.conf
# Enable HSTS only after confirming HTTPS works
# Start conservative
Header always set Strict-Transport-Security "max-age=86400"
# After verification across all subdomains, enable long max-age with subdomains
# Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

# Basic security headers
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Reduce server banner via core directives (set elsewhere):
# ServerTokens Prod
# ServerSignature Off
Header always unset X-Powered-By

Advanced Security Headers (Test Thoroughly)

These headers provide enhanced security but require testing:

# Permissions Policy (formerly Feature Policy)
Header always set Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=()"

# Cross-Origin policies
Header always set Cross-Origin-Opener-Policy "same-origin"
Header always set Cross-Origin-Embedder-Policy "require-corp"
# Note: These policies require cooperating origins. Third-party assets must send CORS or CORP or they will be blocked.

# Content Security Policy - Start with report-only mode
# Header always set Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' https: data:; font-src 'self' https:; connect-src 'self' https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self'"

CSP with Nonce Implementation

Advanced Feature: For dynamic nonce support, enable mod_unique_id:

# Debian/Ubuntu
sudo a2enmod unique_id
sudo systemctl reload apache2

# In VirtualHost or global config:
<IfModule mod_unique_id.c>
  <IfModule mod_headers.c>
      # Generate nonce for CSP
      Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-%{UNIQUE_ID}e'; style-src 'self' 'nonce-%{UNIQUE_ID}e'; img-src 'self' data: https:;"
  </IfModule>
</IfModule>

Warning: Nonce-based CSP requires server-side template processing and may break JavaScript functionality.

Secure File and Directory Permissions

# Document root - web user should have read access only
sudo chown -R root:www-data /var/www/html
sudo find /var/www/html -type f -exec chmod 640 {} \;
sudo find /var/www/html -type d -exec chmod 750 {} \;

# Writable directories (uploads, cache, sessions)
sudo chown -R www-data:www-data /var/www/html/uploads
sudo chown -R www-data:www-data /var/www/html/cache
sudo find /var/www/html/uploads -type f -exec chmod 640 {} \;
sudo find /var/www/html/uploads -type d -exec chmod 2750 {} \;  # setgid bit

# Log directories
sudo chown -R root:adm /var/log/apache2
sudo chmod 755 /var/log/apache2

# Configuration files - root ownership, minimal permissions
sudo chown -R root:root /etc/apache2
sudo find /etc/apache2 -type f -exec chmod 644 {} \;
sudo find /etc/apache2 -type d -exec chmod 755 {} \;

Distribution-Specific Web Users

Server Hardening Directives

# Hide server information
ServerTokens Prod
ServerSignature Off

# Disable TRACE
TraceEnable Off

# Limit request sizes to prevent DoS
LimitRequestBody 10485760  # 10MB

# Timeout settings for security
Timeout 60
KeepAliveTimeout 5
MaxKeepAliveRequests 100

# Disable server-side includes and CGI unless needed
Options -Includes -ExecCGI

# Disable .htaccess overrides for better performance and security
AllowOverride None

# Limit HTTP methods (Apache 2.4 syntax)
<LimitExcept GET POST HEAD>
  Require all denied
</LimitExcept>

Directory Protection

# Protect sensitive directories
<Directory "/var/www/html">
  Options -Indexes -Includes -ExecCGI
  AllowOverride None
  Require all granted

  # Block access to sensitive files
  <FilesMatch "\.(env|ini|conf|config|log|sh|sql|tpl|twig|yml|yaml|bak|backup|swp)$">
      Require all denied
  </FilesMatch>

  # Block access to hidden files (starting with .)
  <FilesMatch "^\.">
      Require all denied
  </FilesMatch>
</Directory>

# Protect uploads directory
<Directory "/var/www/html/uploads">
  Options -Indexes -Includes -ExecCGI
  AllowOverride None
  Require all granted

  # Prevent PHP execution in uploads
  <FilesMatch "\.php$">
      Require all denied
  </FilesMatch>
</Directory>

Installation and Basic Setup

# Debian/Ubuntu
sudo apt update
sudo apt install -y libapache2-mod-security2 modsecurity-crs

# RHEL/Fedora/CentOS
sudo dnf install -y mod_security mod_security_crs

# Enable ModSecurity
sudo a2enmod security2  # Debian/Ubuntu
# RHEL: Ensure LoadModule security2_module modules/mod_security2.so

# Create ModSecurity configuration directory
sudo mkdir -p /etc/modsecurity

ModSecurity Configuration

# Copy and configure main configuration
sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

# Edit configuration for production use
sudo nano /etc/modsecurity/modsecurity.conf

# Key configuration settings:
SecRuleEngine DetectionOnly  # Start in detection-only mode
SecRequestBodyLimit 134217728  # 128MB
SecRequestBodyNoFilesLimit 131072  # 128KB
SecRequestBodyInMemoryLimit 131072
SecRequestBodyAccess On
SecRule REQUEST_HEADERS:Content-Type "text/xml" "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
SecRule REQUEST_HEADERS:Content-Type "application/json" "id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"

OWASP Core Rule Set Setup

# Configure OWASP CRS (Debian/Ubuntu)
sudo cp -r /usr/share/modsecurity-crs /etc/apache2/
sudo mv /etc/apache2/modsecurity-crs /etc/apache2/modsecurity-crs-activated

# Enable CRS rules
sudo ln -s /etc/apache2/modsecurity-crs-activated/crs-setup.conf /etc/apache2/modsecurity-crs-setup.conf
sudo ln -s /etc/apache2/modsecurity-crs-activated/rules /etc/apache2/modsecurity-rules

# Include in Apache configuration
echo 'Include /etc/apache2/modsecurity-crs-setup.conf' | sudo tee -a /etc/apache2/mods-enabled/security2.conf
echo 'Include /etc/apache2/modsecurity-rules/*.conf' | sudo tee -a /etc/apache2/mods-enabled/security2.conf

Testing and Monitoring

# Test ModSecurity configuration
sudo apachectl -t

# Restart Apache
sudo systemctl restart apache2

# Test with a simple attack vector
curl -H "User-Agent: nikto" http://localhost/

# Check ModSecurity logs
sudo tail -f /var/log/apache2/modsec_audit.log
sudo tail -f /var/log/modsec_debug.log

# When confident, switch to blocking mode
# Change in /etc/modsecurity/modsecurity.conf:
# SecRuleEngine On

Fail2Ban Protection

# Install Fail2Ban
sudo apt install -y fail2ban  # Debian/Ubuntu
sudo dnf install -y fail2ban  # RHEL/Fedora

# Create Apache jail configuration
sudo tee /etc/fail2ban/jail.d/apache.conf >/dev/null <<'EOF'
[apache-auth]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/apache2/*error.log
maxretry = 3
bantime = 3600
findtime = 600

[apache-badbots]
enabled = true
port = http,https
filter = apache-badbots
logpath = /var/log/apache2/*access.log
maxretry = 2
bantime = 86400
findtime = 600

[apache-botsearch]
enabled = true
port = http,https
filter = apache-botsearch
logpath = /var/log/apache2/*access.log
maxretry = 10
bantime = 86400
findtime = 600
EOF

# Start and enable Fail2Ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

SSL/TLS Security Hardening

# Strong TLS configuration (in SSL VirtualHost)
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
TLSCipherSuite TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256

SSLHonorCipherOrder off
SSLSessionTickets off

# Enable OCSP stapling
SSLUseStapling on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"

Testing Commands

# Test security headers
curl -I https://yourdomain.com

# SSL/TLS testing
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com

# Security scanning tools
sudo apt install -y nikto  # Web vulnerability scanner
nikto -h https://yourdomain.com

# Check for open ports
sudo netstat -tulpn | grep :80
sudo netstat -tulpn | grep :443

# Verify file permissions
sudo find /var/www/html -type f -perm /o=w -ls  # World-writable files
sudo find /var/www/html -type f -name "*.php" -perm /g=w -ls  # Group-writable PHP files