{"id":11393,"date":"2023-10-23T10:57:06","date_gmt":"2023-10-23T10:57:06","guid":{"rendered":"https:\/\/realjossy.com\/blog\/?p=11393"},"modified":"2023-11-04T21:28:03","modified_gmt":"2023-11-04T21:28:03","slug":"web-server-security","status":"publish","type":"post","link":"https:\/\/realjossy.com\/blog\/web-server-security\/","title":{"rendered":"Top 20 Best Practices for Web Server Security"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2023\/11\/Top-20-Best-Practices-for-Web-Server-Security-2-1024x576.png\" alt=\"Web Server Security\" class=\"wp-image-11767\" srcset=\"https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2023\/11\/Top-20-Best-Practices-for-Web-Server-Security-2-1024x576.png 1024w, https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2023\/11\/Top-20-Best-Practices-for-Web-Server-Security-2-300x169.png 300w, https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2023\/11\/Top-20-Best-Practices-for-Web-Server-Security-2-768x432.png 768w, https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2023\/11\/Top-20-Best-Practices-for-Web-Server-Security-2-1536x864.png 1536w, https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2023\/11\/Top-20-Best-Practices-for-Web-Server-Security-2-2048x1152.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Ensuring web server security is crucial for safeguarding your web applications and the data they manage against various threats such as malicious activities, hacking attempts, and data breaches. The following are some essential factors and recommended procedures to improve web server security:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Can Security Be Assured on a Server?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To avoid data loss or security breaches, it&#8217;s crucial to secure your server. Security is a topic that many people find difficult, so it frequently goes unheeded. When a problem occurs, many people are unprepared. You may dramatically reduce your risk of getting hacked by a bad actor by adhering to these best practices.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Optimum server security procedures<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Server Administration<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Achieving peak server operations performance requires proper server management to guarantee that all activity continues to adhere to organizational requirements. This includes taking internal and external security measures and employing qualified system administrators.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Physical Protection<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Physical security measures are put in place to help stop unauthorized individuals from physically accessing servers, routers, and wiring closets. Every firm needs physical access control (PAC), which includes locks, biometric authentication, and other hardware like badges.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The most fundamental type of physical access control system are conventional doors and locks, but enterprise-grade physical access control systems offer much more. In portions of a building with public access areas and limited access areas, for example, access controls could be stricter.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A security best practice is to keep the credential database updated and to remove any inactive users. Additionally, adding several PACs is an excellent way to increase the security of physical access control for susceptible<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Upgrade operating systems and software<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The most important security measure you can take for your server is to keep software and operating systems (OS) updated. Critical vulnerability patches and modest bug fixes are also included in updates. The urgency with which consumers should install updates is increased by the fact that many software vulnerabilities are patched as soon as they are made public.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Faults may go undetected in server systems because of the complicated interactions they frequently have with software environments. Your server will inevitably become vulnerable if your operating system and any other applications are not kept up to date. To ensure security, businesses must prepare to implement frequent updates and fixes in a timely manner.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The upkeep of the credential database and removal of any inactive users is<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Safe Connections<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>SSH<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Use a secure shell (SSH) connection whenever access to the server&#8217;s command line (terminal) is required. SSH establishes a secure data conduit. Only the data passed from the PC to the server through the terminal is secured by this connection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The SSH port is another item to think about. The default port for SSH is 22. The best practice advises avoiding this port and, for added integrity, utilizing a port range of 32768 to 61000. This modification shields the connection and main hacking radars from automated attacks.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Keys SSH<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Use an SSH key rather than an SSH password to access the server. They remove the necessity for a root password by disabling the SSH feature required to connect to the server as the root user. When connecting to the server, it adds an extra degree of security over just using a password.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can generate a cryptographically secure keypair using SSH keys that keeps particular connection data locally on your computer and the server. Because SSH key pairs are generated cryptographically, the more secure they are, the bigger the key size.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Since they conceal any network users behind the proxy&#8217;s IP address and host firewalls, proxy servers are an alternative as an additional security precaution. In this configuration, it<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">MFA, or multi-factor authentication<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The major single-factor authentication mechanism is SSH keys. To access sensitive data, a user would need to provide multiple pieces of information (such as a phone number, email address, and government ID). This is known as two-factor or multi-factor authentication.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">VPN<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A virtual private network (VPN) is a secure link from a distant location to a local, private network. It guarantees the security of private data and upholds the confidentiality and accuracy of the data. Using a VPN secures your connection to the Internet and offers privacy and protection when communicating and browsing online.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Fail2Ban<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A server program called Fail2ban discourages or blocks remote connections that make brute-force attempts at access. It enables you to keep tabs on the severity and frequency of attacks, and updates to firewall rules are made to temporarily block dubious IP addresses. Numerous protocols, including HTTP, SSH, and SMTP, can be watched by Fail2Ban. Fail2Ban serves as a good security deterrent for any server, although by default it simply monitors SSH.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">SSL\/TLS<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Server security certificates, like those for Secure Sockets Layer (SSL) and Transport Layer Security (TLS), are yet another reliable measure of protection. With TLS being a more recent form of SSL, these security certificates are cryptographic mechanisms for authentication and encryption. Older SSL protocols had some security flaws that TLS fixes, and these certificates are necessary for user authentication.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By encrypting critical information sent over the internet, such as passwords, usernames, and credit card numbers, server security certificates safeguard network connections and enable servers to validate entities.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-restricting-root-access\">Restricting Root Access<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">SSH should be restricted to a limited subset of users. To do this, add the following information to the&nbsp;<em>\/etc\/ssh\/sshd_config<\/em>&nbsp;file.<\/p>\n\n\n\nPermitRootLogin no\nProtocol 2\n\n\n\n<p class=\"wp-block-paragraph\">Then, add the SSH users group to the \/etc\/ssh\/sshd_config file.<\/p>\n\n\n\nAllowGroups sshusers\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Turn off pointless services<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Services in Audit<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Service auditing investigates which services are currently active on the server, the protocols they employ, and the ports they communicate over. Being aware of these elements will aid in reducing the system&#8217;s attack vectors.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can use a variety of the server&#8217;s functions because many servers come with some services enabled by default. It is preferable to disable these extra services if they aren&#8217;t being used. You can locate and disable unused services on a Red Hat-based system by running particular commands.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Services Supported by Red Hat\/CentOS<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Run the following command to see the enabled services in Red Hat or CentOS.<\/p>\n\n\n\nsystemctl list-unit-files | grep enabled\n\n\n\n<p class=\"wp-block-paragraph\">The result is this.<\/p>\n\n\n\n[root@host ~]# systemctl list-unit-files | grep enabled\nvar-lib-snapd-snap-core-7917.mount            enabled \nvar-lib-snapd-snap-hello\\x2dworld-29.mount    enabled \nvar-lib-snapd-snap-snapcraft-3440.mount       enabled \nacpid.service                                 enabled \nauditd.service                                enabled \nautovt@.service                               enabled \ncrond.service                                 enabled \ndbus-org.fedoraproject.FirewallD1.service     enabled \nfirewalld.service                             enabled \ngetty@.service                                enabled \nirqbalance.service                            enabled \nmicrocode.service                             enabled \nNetworkManager-wait-online.service            enabled \npostfix.service                               enabled \nqemu-guest-agent.service                      enabled \nrhel-autorelabel.service                      enabled \nrhel-configure.service                        enabled \nrhel-dmesg.service                            enabled \nrhel-domainname.service                       enabled \nrhel-import-state.service                     enabled \nrhel-loadmodules.service                      enabled \nrhel-readonly.service                         enabled \nrsyslog.service                               enabled \nsonarpush.service                             enabled \nsshd.service                                  enabled \nsystemd-readahead-collect.service             enabled \nsystemd-readahead-drop.service                enabled \nsystemd-readahead-replay.service              enabled \ntuned.service                                 enabled \nsnapd.socket                                  enabled \ndefault.target                                enabled \nmulti-user.target                             enabled \nremote-fs.target                              enabled \nrunlevel2.target                              enabled \nrunlevel3.target                              enabled \nrunlevel4.target                              enabled \n[root@host ~]#\n\n\n\n<p class=\"wp-block-paragraph\">The next command displays the services that are active.<\/p>\n\n\n\nsystemctl | grep running\n\n\n\n<p class=\"wp-block-paragraph\">The result is as shown below.<\/p>\n\n\n\n[root@host ~]# systemctl | grep running\nsession-2969.scope                  loaded active running   Session 2969 of user root\nacpid.service                       loaded active running   ACPI Event Daemon\nauditd.service                      loaded active running   Security Auditing Service\ncrond.service                       loaded active running   Command Scheduler\ndbus.service                        loaded active running   D-Bus System Message Bus\nfirewalld.service                   loaded active running   firewalld &#8211; dynamic firewall daemon\ngetty@tty1.service                  loaded active running   Getty on tty1\nirqbalance.service                  loaded active running   irqbalance daemon\npolkit.service                      loaded active running   Authorization Manager\npostfix.service                     loaded active running   Postfix Mail Transport Agent\nrsyslog.service                     loaded active running   System Logging Service\nserial-getty@ttyS0.service          loaded active running   Storm management console on Serial Getty ttyS0\nsnapd.service                       loaded active running   Snappy daemon\nsonarpush.service                   loaded active running   Realjossy Sonarpush Monitoring Agent\nsshd.service                        loaded active running   OpenSSH server daemon\nsystemd-journald.service            loaded active running   Journal Service\nsystemd-logind.service              loaded active running   Login Service\nsystemd-udevd.service               loaded active running   udev Kernel Device Manager\ntuned.service                       loaded active running   Dynamic System Tuning Daemon\ndbus.socket                         loaded active running   D-Bus System Message Bus Socket\nsnapd.socket                        loaded active running   Socket activation for snappy daemon\nsystemd-journald.socket             loaded active running   Journal Socket\nsystemd-udevd-control.socket        loaded active running   udev Control Socket\nsystemd-udevd-kernel.socket         loaded active running   udev Kernel Socket\n[root@host ~]#\n\n\n\n<p class=\"wp-block-paragraph\">Use this command to turn off a service, such as Bluetooth.<\/p>\n\n\n\nsystemctl disable bluetooth\n\n\n\n<h3 class=\"wp-block-heading\">Ubuntu\/Debian Running Services<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">On a server running Debian or Ubuntu, the ensuing command displays the services that are now active.<\/p>\n\n\n\nservice &#8211;status-all |grep &#8216;+&#8217;\n\n\n\n<p class=\"wp-block-paragraph\">This is the result.<\/p>\n\n\n\nroot@host ~# service &#8211;status-all |grep &#8216;+&#8217;\n [ + ]  apache-htcacheclean\n [ + ]  apache2\n [ + ]  apparmor\n [ + ]  apport\n [ + ]  atd\n [ + ]  binfmt-support\n [ + ]  cron\n [ + ]  dbus\n [ + ]  ebtables\n [ + ]  grub-common\n [ + ]  irqbalance\n [ + ]  iscsid\n [ + ]  lvm2-lvmetad\n [ + ]  lvm2-lvmpolld\n [ + ]  lxcfs\n [ + ]  procps\n [ + ]  rsyslog\n [ + ]  ssh\n [ + ]  udev\n [ + ]  ufw\n [ + ]  unattended-upgrades\nroot@host ~#\n\n\n\n<p class=\"wp-block-paragraph\">The status of the services governed by systemV are listed by this command. The active status of the service is indicated by the plus (+) and negative (-) symbols.<\/p>\n\n\n\nsystemctl | grep running\n\n\n\n<p class=\"wp-block-paragraph\">The result is shown in the following.<\/p>\n\n\n\nroot@host ~# systemctl | grep running\n  proc-sys-fs-binfmt_misc.automount        loaded active running   Arbitrary Executable File Formats File System Automount Point\n  init.scope                               loaded active running   System and Service Manager\n  session-1726.scope                       loaded active running   Session 1726 of user root\n  accounts-daemon.service                  loaded active running   Accounts Service\n  apache2.service                          loaded active running   The Apache HTTP Server\n  atd.service                              loaded active running   Deferred execution scheduler\n  cron.service                             loaded active running   Regular background program processing daemon\n  dbus.service                             loaded active running   D-Bus System Message Bus\n  getty@tty1.service                       loaded active running   Getty on tty1\n  irqbalance.service                       loaded active running   irqbalance daemon\n  lvm2-lvmetad.service                     loaded active running   LVM2 metadata daemon\n  lxcfs.service                            loaded active running   FUSE filesystem for LXC\n  networkd-dispatcher.service              loaded active running   Dispatcher daemon for systemd-networkd\n  polkit.service                           loaded active running   Authorization Manager\n  rsyslog.service                          loaded active running   System Logging Service\n  serial-getty@ttyS0.service               loaded active running   Storm management console on Serial Getty ttyS0\n  snapd.service                            loaded active running   Snappy daemon\n  ssh.service                              loaded active running   OpenBSD Secure Shell server\n  systemd-journald.service                 loaded active running   Journal Service\n  systemd-logind.service                   loaded active running   Login Service\n  systemd-networkd.service                 loaded active running   Network Service\n  systemd-resolved.service                 loaded active running   Network Name Resolution\n  systemd-timesyncd.service                loaded active running   Network Time Synchronization\n  systemd-udevd.service                    loaded active running   udev Kernel Device Manager\n  unattended-upgrades.service              loaded active running   Unattended Upgrades Shutdown\n  user@0.service                           loaded active running   User Manager for UID 0\n  dbus.socket                              loaded active running   D-Bus System Message Bus Socket\n  lvm2-lvmetad.socket                      loaded active running   LVM2 metadata daemon socket\n  snapd.socket                             loaded active running   Socket activation for snappy daemon\n  syslog.socket                            loaded active running   Syslog Socket\n  systemd-journald-audit.socket            loaded active running   Journal Audit Socket\n  systemd-journald-dev-log.socket          loaded active running   Journal Socket (\/dev\/log)\n  systemd-journald.socket                  loaded active running   Journal Socket\n  systemd-udevd-control.socket             loaded active running   udev Control Socket\n  systemd-udevd-kernel.socket              loaded active running   udev Kernel Socket\nroot@host ~#\n\n\n\n<p class=\"wp-block-paragraph\">Make use of the following command to disable a service.<\/p>\n\n\n\nsystemctl disable apache\n\n\n\n<h3 class=\"wp-block-heading\">Take X Windows out of the system.<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">On Unix-like operating systems, the X Window System, also known as X11 or simply X, is the default windowing system for bitmap displays. It offers the fundamental structure for a GUI environment with windows. X.org is the name of the X Windows system that is a part of CentOS, Red Hat Enterprise Linux (RHEL), and Fedora Linux.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For most servers, a management panel is sufficient for performing basic server administration chores. Knowing how many open paths there are to the server is useful so you can only enable those that you actually need. If X Windows is already installed and your server doesn&#8217;t need it, you should delete it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This command can be used to uninstall the Windows X system.<\/p>\n\n\n\nyum groupremove &#8220;X Window System&#8221;\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Maintain Backups<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Any firm may suffer a catastrophic loss if vital data were lost. Fortunately, there are lots of trustworthy backup options out there, such server backup software that can support both physical and virtual servers.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Three-two-one rule<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Make three duplicates of your data. Two backup copies and one primary copy should make up these copies.<\/li>\n\n\n\n<li>A minimum of two different types of storage media should be used to store the copies of your data. One duplicate can be maintained locally on your hard disk, while the second one can be kept remotely on a network-attached storage (NAS) device or locally on a storage server.<\/li>\n\n\n\n<li>One: Keep one copy of the data offsite. This alternative can be a storage server kept elsewhere or a cloud storage system with a hosting company.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>User Administration<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Follow up on login attempts<br>Applications of the sort known as host intrusion detection systems (HIDS) keep an eye out on networks and devices for any unusual activity. It looks at data in the kernel logs as well as accessible files, run apps, and data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A program called Network Intrusion Detection Systems (NIDS) scans network traffic for unusual behaviour. It assesses the data exchange between connected devices.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">NDIS is utilized for a LAN-based solution, while HIDS is used for a more comprehensive solution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HIDS are listed below:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>(A clone of OSSEC that provides greater dependability and scalability) OSSEC Wazuh<\/li>\n\n\n\n<li>Onion Tripwire Samhain Security<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Combining NIDS with HIDS can result in a strong, all-encompassing intrusion detection system strategy. Several suggestions are as follows:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.snort.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">Snort<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/suricata.io\/\" target=\"_blank\" rel=\"noreferrer noopener\">Suricata<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.zeek.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">Zeek<\/a><\/li>\n\n\n\n<li><a href=\"http:\/\/openwips-ng.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">OpenWIPS-ng<\/a><\/li>\n\n\n\n<li><a href=\"http:\/\/bammv.github.io\/sguil\/index.html\" target=\"_blank\" rel=\"noreferrer noopener\">Sguil b<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Decrease User Permissions<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Limit the permission sets that users have to 644 or 444 for files and 755 for folders to guarantee that only the necessary users have access to essential systems.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Administer user testing<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Set a date for performing a security audit and let users know in advance. Set clear expectations and hold them responsible for any shortcomings.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Ongoing security education<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Send out monthly reminders, do training every three months, and conduct dry runs over a six-month period in several areas (email, network, and physical). You should also keep track of failures so you can make improvements and provide more training in those areas.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Journey Safety<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Your company&#8217;s front door is not where security stops. In the modern world, setting up security parameter training for staff members who travel internationally is a prudent decision, made the more so given that many businesses have gone totally remote or have set up remote weeks for specific departments.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Utilize SELinux.<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A means for supporting access control security policies, such as mandatory access controls (MAC), is provided by the kernel-based security module SELinux. It is usually employed to modify access control requirements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can specify what a process or user is allowed to perform with SELinux. It can restrict operations to their domain so that actions can only communicate with specific file types or other processes from approved domains.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Any one of the following three configurations for SELinux is possible:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SELinux actively carries out the defined policy&#8217;s enforcement.<\/li>\n\n\n\n<li>Mostly used for testing, permissive. Enforcement is logged but not actually imposed.<\/li>\n\n\n\n<li>System is inactive when it is disabled.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Education and Information<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you don&#8217;t know what to look for or what questions to ask, important things can go missed. To be safe, you don&#8217;t have to be an expert in security, but you do need to be aware of the threats to your company.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The idea that a fully managed server service provides all the protection you require is a frequent one. However, hosting companies collaborate with you and your team to guarantee the security of your environment. Your data is your responsibility, but the hosting provider makes sure the hardware, network, and facilities are secure. You and your team need to become knowledgeable about typical security concerns and how to protect your websites and applications against them.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Filesystem Security<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The server filesystem can be protected in a number of ways. Start by mounting user-writable filesystems on distinct partitions at all times. Use the text editor of your choice to add the following commands to the \/etc\/fstab file: nosuid, nodev, and noexec.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Consider the following additional settings:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Make \/boot Read-Only.<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Even though it is only used to read or load modules and the kernel, make sure the \/boot subdirectory is set to RW mode by default. For this, enter the following command.<\/p>\n\n\n\n\/dev\/sda1 \/boot ext2 defaults ro 1 2\n\n\n\n<p class=\"wp-block-paragraph\">Also, set&nbsp;<em>\/boot<\/em>&nbsp;to read-only in the&nbsp;<em>\/etc\/fstab<\/em>&nbsp;file.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Stop using removable media when starting up<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Depending on how you utilize your server, this setting is optional. You must change the bios option to prevent booting from removable media, such as a USB stick, in order to prohibit booting from removable media.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">GRUB Bootloader Password must be set.<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The server can be accessed by anyone who has physical access to it. The GRUB bootloader password is another barrier between a hacker and server access. By limiting access with a password, you can achieve this. Create a backup of the current grub.conf file first.<\/p>\n\n\n\nroot@host ~# cp \/etc\/grub.conf \/etc\/grub.conf.bak\n\n\n\n<p class=\"wp-block-paragraph\">Make a strong password next. Make a file, then use the grub-md5-crypt command to generate a password for it. Then, you will be asked for a password twice. The created password should then be copied into the grub.conf file from the secure file.<\/p>\n\n\n\nroot@host ~# touch secure\nroot@host ~# grub-md5-crypt > secure\n\n\n\n<p class=\"wp-block-paragraph\">The password should now be copied and pasted after the first line (in RedHat) of the grub.conf file, as seen below. Next, save the file and close it.<\/p>\n\n\n\nsplashimage=(hd0,0)\/grub\/splash.xpm.gz \npassword &#8211;md5 JnK!xdBep53lt1NVk@K6wb!js%!HEI#^\n\n\n\n<p class=\"wp-block-paragraph\">To make the changes effective, you must restart the server.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Before entering single-user mode, ask for the root password<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">By pressing the e key to access the GRUB menu item, a malicious user can choose a particular kernel to boot onto if they have physical access to the server. With this operation, it is possible to change the initial boot option to enable single-user mode booting without a password prompt.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To prevent potential exploitation, your system should be set up to ask for the root password before switching to single-user mode. This can be done by following the directions in the Set a GRUB Bootloader Password section.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IMPORTANT WEB SERVER SECURITY PRACTICES<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Regular Updates<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Keep your web server software, operating system, and all installed components (such as web applications and databases) up to date with security patches. Vulnerabilities in outdated software can be exploited by attackers. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Minimal Installation: <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Install only the necessary components and services. A minimal installation reduces the attack surface and minimizes potential vulnerabilities. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Firewall<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use a firewall to control incoming and outgoing network traffic. Restrict access to only the necessary ports and services, and consider implementing a &#8220;default deny&#8221; policy. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Secure Configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ensure that your web server and associated software are configured securely. Disable unnecessary features, restrict file permissions, and use strong, unique passwords. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">HTTPS<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Implement HTTPS (SSL\/TLS) for secure data transmission. Use trusted SSL\/TLS certificates to encrypt data between the client and the server. Let&#8217;s Encrypt provides free SSL certificates. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Web Application Firewalls (WAF)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Deploy a WAF to filter out malicious traffic, protect against common web application vulnerabilities like SQL injection and XSS, and provide an additional layer of security. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Access Control<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Enforce proper access control mechanisms. Use role-based access control (RBAC) and least privilege principles to limit user and application permissions. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Security Headers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Implement security headers in your web server&#8217;s configuration to mitigate common web security risks. Examples include Content Security Policy (CSP) and X-Content-Type-Options. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Regular Backups<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Perform regular backups of your web server and web application data. Ensure that backups are securely stored and regularly tested for restoration. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Monitoring and Logging<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Set up comprehensive monitoring and logging to detect suspicious activities and unauthorized access. Analyze logs regularly to identify potential security incidents. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Intrusion Detection System (IDS)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Deploy an IDS to detect and respond to suspicious behavior or intrusion attempts in real-time. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Security Updates and Patch Management<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Stay informed about security vulnerabilities and apply patches promptly. Implement a process for testing updates before applying them to production systems.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Secure File Uploads<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If your application allows file uploads, validate and restrict file types, and store uploaded files outside the web root to prevent direct execution. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">DDoS Mitigation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Protect against Distributed Denial of Service (DDoS) attacks with dedicated DDoS mitigation solutions or services. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Security Training<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Educate your team on web security best practices and keep them informed about emerging threats and attack vectors. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Strong Authentication<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Implement strong, multi-factor authentication (MFA) for server access and web application logins. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Incident Response Plan<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Develop an incident response plan that outlines steps to take in case of a security breach. Be prepared to contain, investigate, and recover from security incidents. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Security Testing<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Regularly perform security assessments such as penetration testing and vulnerability scanning to identify and address weaknesses in your web server and applications. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Final Reflections<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Web server security is an ongoing process, and it requires continuous monitoring and adaptation to address evolving threats. By following these best practices and staying informed about the latest security developments, you can better protect your web server and the data it handles.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We all share a concern for security. Be sure you work with your hosting company and adhere to these server security best practices. All of this provides the security your server environment needs to thrive.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Also Read: <a href=\"https:\/\/realjossy.com\/blog\/web-server-security\/\">Best Practices for Web Server Security<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Also Read: <a href=\"https:\/\/realjossy.com\/blog\/when-should-i-upgrade-my-server\/\">When Should Your Server Be Upgraded?<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Also Read: <a href=\"https:\/\/realjossy.com\/blog\/how-to-fix-500-internal-server-error\/\">How to Fix 500 Internal Server Error<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Also Read: <a href=\"https:\/\/realjossy.com\/blog\/dedicated-server-ecommerce-hosting\/\">Why Dedicated Server Hosting is Necessary for eCommerce Sites<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ensuring web server security is crucial for safeguarding your web applications and the data they manage against various threats such [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":11652,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[9,26],"tags":[],"class_list":["post-11393","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech","category-web-hosting"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Web Server Security | Top 20 Best Practices for Web Server Security<\/title>\n<meta name=\"description\" content=\"Web Server Security | Achieving peak server operations performance requires proper server management to guarantee that all activity continues\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/realjossy.com\/blog\/web-server-security\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Web Server Security | Top 20 Best Practices for Web Server Security\" \/>\n<meta property=\"og:description\" content=\"Web Server Security | Achieving peak server operations performance requires proper server management to guarantee that all activity continues\" \/>\n<meta property=\"og:url\" content=\"https:\/\/realjossy.com\/blog\/web-server-security\/\" \/>\n<meta property=\"og:site_name\" content=\"Realjossy\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/facebook.com\/officialrealjossy\" \/>\n<meta property=\"article:published_time\" content=\"2023-10-23T10:57:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-11-04T21:28:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2023\/10\/Best-Practices-for-Web-Server-Security-1024x576.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"576\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Divine Kingsley\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@realjossyblog\" \/>\n<meta name=\"twitter:site\" content=\"@realjossyblog\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Divine Kingsley\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"16 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/web-server-security\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/web-server-security\\\/\"},\"author\":{\"name\":\"Divine Kingsley\",\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/#\\\/schema\\\/person\\\/18219de017b02e07fdc883062dca1cdd\"},\"headline\":\"Top 20 Best Practices for Web Server Security\",\"datePublished\":\"2023-10-23T10:57:06+00:00\",\"dateModified\":\"2023-11-04T21:28:03+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/web-server-security\\\/\"},\"wordCount\":3569,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/web-server-security\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/Best-Practices-for-Web-Server-Security.png\",\"articleSection\":[\"Tech\",\"Web Hosting\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/realjossy.com\\\/blog\\\/web-server-security\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/web-server-security\\\/\",\"url\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/web-server-security\\\/\",\"name\":\"Web Server Security | Top 20 Best Practices for Web Server Security\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/web-server-security\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/web-server-security\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/Best-Practices-for-Web-Server-Security.png\",\"datePublished\":\"2023-10-23T10:57:06+00:00\",\"dateModified\":\"2023-11-04T21:28:03+00:00\",\"description\":\"Web Server Security | Achieving peak server operations performance requires proper server management to guarantee that all activity continues\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/web-server-security\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/realjossy.com\\\/blog\\\/web-server-security\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/web-server-security\\\/#primaryimage\",\"url\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/Best-Practices-for-Web-Server-Security.png\",\"contentUrl\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/Best-Practices-for-Web-Server-Security.png\",\"width\":2560,\"height\":1440,\"caption\":\"Web Server Security\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/web-server-security\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Top 20 Best Practices for Web Server Security\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/\",\"name\":\"Realjossy\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/#organization\",\"name\":\"Realjossy\",\"url\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/realjossy-logo1.png\",\"contentUrl\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/realjossy-logo1.png\",\"width\":564,\"height\":565,\"caption\":\"Realjossy\"},\"image\":{\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/facebook.com\\\/officialrealjossy\",\"https:\\\/\\\/x.com\\\/realjossyblog\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/#\\\/schema\\\/person\\\/18219de017b02e07fdc883062dca1cdd\",\"name\":\"Divine Kingsley\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c0f692d035126a1d7117798f3648a6a88825e525a452d3acfb32a97f0cecf666?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c0f692d035126a1d7117798f3648a6a88825e525a452d3acfb32a97f0cecf666?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c0f692d035126a1d7117798f3648a6a88825e525a452d3acfb32a97f0cecf666?s=96&d=mm&r=g\",\"caption\":\"Divine Kingsley\"},\"url\":\"https:\\\/\\\/realjossy.com\\\/blog\\\/author\\\/divine\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Web Server Security | Top 20 Best Practices for Web Server Security","description":"Web Server Security | Achieving peak server operations performance requires proper server management to guarantee that all activity continues","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/realjossy.com\/blog\/web-server-security\/","og_locale":"en_US","og_type":"article","og_title":"Web Server Security | Top 20 Best Practices for Web Server Security","og_description":"Web Server Security | Achieving peak server operations performance requires proper server management to guarantee that all activity continues","og_url":"https:\/\/realjossy.com\/blog\/web-server-security\/","og_site_name":"Realjossy","article_publisher":"https:\/\/facebook.com\/officialrealjossy","article_published_time":"2023-10-23T10:57:06+00:00","article_modified_time":"2023-11-04T21:28:03+00:00","og_image":[{"width":1024,"height":576,"url":"https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2023\/10\/Best-Practices-for-Web-Server-Security-1024x576.png","type":"image\/png"}],"author":"Divine Kingsley","twitter_card":"summary_large_image","twitter_creator":"@realjossyblog","twitter_site":"@realjossyblog","twitter_misc":{"Written by":"Divine Kingsley","Est. reading time":"16 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/realjossy.com\/blog\/web-server-security\/#article","isPartOf":{"@id":"https:\/\/realjossy.com\/blog\/web-server-security\/"},"author":{"name":"Divine Kingsley","@id":"https:\/\/realjossy.com\/blog\/#\/schema\/person\/18219de017b02e07fdc883062dca1cdd"},"headline":"Top 20 Best Practices for Web Server Security","datePublished":"2023-10-23T10:57:06+00:00","dateModified":"2023-11-04T21:28:03+00:00","mainEntityOfPage":{"@id":"https:\/\/realjossy.com\/blog\/web-server-security\/"},"wordCount":3569,"commentCount":0,"publisher":{"@id":"https:\/\/realjossy.com\/blog\/#organization"},"image":{"@id":"https:\/\/realjossy.com\/blog\/web-server-security\/#primaryimage"},"thumbnailUrl":"https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2023\/10\/Best-Practices-for-Web-Server-Security.png","articleSection":["Tech","Web Hosting"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/realjossy.com\/blog\/web-server-security\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/realjossy.com\/blog\/web-server-security\/","url":"https:\/\/realjossy.com\/blog\/web-server-security\/","name":"Web Server Security | Top 20 Best Practices for Web Server Security","isPartOf":{"@id":"https:\/\/realjossy.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/realjossy.com\/blog\/web-server-security\/#primaryimage"},"image":{"@id":"https:\/\/realjossy.com\/blog\/web-server-security\/#primaryimage"},"thumbnailUrl":"https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2023\/10\/Best-Practices-for-Web-Server-Security.png","datePublished":"2023-10-23T10:57:06+00:00","dateModified":"2023-11-04T21:28:03+00:00","description":"Web Server Security | Achieving peak server operations performance requires proper server management to guarantee that all activity continues","breadcrumb":{"@id":"https:\/\/realjossy.com\/blog\/web-server-security\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/realjossy.com\/blog\/web-server-security\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/realjossy.com\/blog\/web-server-security\/#primaryimage","url":"https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2023\/10\/Best-Practices-for-Web-Server-Security.png","contentUrl":"https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2023\/10\/Best-Practices-for-Web-Server-Security.png","width":2560,"height":1440,"caption":"Web Server Security"},{"@type":"BreadcrumbList","@id":"https:\/\/realjossy.com\/blog\/web-server-security\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/realjossy.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Top 20 Best Practices for Web Server Security"}]},{"@type":"WebSite","@id":"https:\/\/realjossy.com\/blog\/#website","url":"https:\/\/realjossy.com\/blog\/","name":"Realjossy","description":"","publisher":{"@id":"https:\/\/realjossy.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/realjossy.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/realjossy.com\/blog\/#organization","name":"Realjossy","url":"https:\/\/realjossy.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/realjossy.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2022\/04\/realjossy-logo1.png","contentUrl":"https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2022\/04\/realjossy-logo1.png","width":564,"height":565,"caption":"Realjossy"},"image":{"@id":"https:\/\/realjossy.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/facebook.com\/officialrealjossy","https:\/\/x.com\/realjossyblog"]},{"@type":"Person","@id":"https:\/\/realjossy.com\/blog\/#\/schema\/person\/18219de017b02e07fdc883062dca1cdd","name":"Divine Kingsley","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/c0f692d035126a1d7117798f3648a6a88825e525a452d3acfb32a97f0cecf666?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/c0f692d035126a1d7117798f3648a6a88825e525a452d3acfb32a97f0cecf666?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c0f692d035126a1d7117798f3648a6a88825e525a452d3acfb32a97f0cecf666?s=96&d=mm&r=g","caption":"Divine Kingsley"},"url":"https:\/\/realjossy.com\/blog\/author\/divine\/"}]}},"jetpack-related-posts":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/realjossy.com\/blog\/wp-content\/uploads\/2023\/10\/Best-Practices-for-Web-Server-Security.png","_links":{"self":[{"href":"https:\/\/realjossy.com\/blog\/wp-json\/wp\/v2\/posts\/11393","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/realjossy.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/realjossy.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/realjossy.com\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/realjossy.com\/blog\/wp-json\/wp\/v2\/comments?post=11393"}],"version-history":[{"count":4,"href":"https:\/\/realjossy.com\/blog\/wp-json\/wp\/v2\/posts\/11393\/revisions"}],"predecessor-version":[{"id":11771,"href":"https:\/\/realjossy.com\/blog\/wp-json\/wp\/v2\/posts\/11393\/revisions\/11771"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/realjossy.com\/blog\/wp-json\/wp\/v2\/media\/11652"}],"wp:attachment":[{"href":"https:\/\/realjossy.com\/blog\/wp-json\/wp\/v2\/media?parent=11393"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/realjossy.com\/blog\/wp-json\/wp\/v2\/categories?post=11393"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/realjossy.com\/blog\/wp-json\/wp\/v2\/tags?post=11393"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}