Apache Security Configurations

Apache Security Configurations

Additional security for PHP applications hosted with Apache can be configured either in the main httpd.conf file or through a directory-level .htaccess file.

In this article

Configuration Methods

httpd.confApply security directives through the main Apache configuration file.
.htaccessPlace one or more directives inside the application directory to override a permitted subset of the global configuration.

The AllowOverride directive determines what can be placed in .htaccess. When it is set to None, these files are ignored. When set to All, directives with an .htaccess context are allowed.

Set Up Authentication

1

Generate a password hash

Use an htpasswd tool to generate the hashed password.

2

Create the password file

Create a plain text file containing the generated username and hash.

3

Upload the file

Click Config for the Apache server and upload the file to /var/www/webroot/ROOT.

4

Protect the application

Open /etc/httpd/conf/httpd.conf or the application .htaccess file and add:

AuthName "Restricted area"
AuthType Basic
AuthBasicProvider file
AuthUserFile /var/www/webroot/ROOT/.htpasswd
Require valid-user
Apache application authentication
Add Basic authentication directives for the complete application.

To protect only one directory, wrap the authentication directives inside a Location block:

<Location /directory_path>
AuthName "Restricted area"
AuthType Basic
AuthBasicProvider file
AuthUserFile /var/www/webroot/ROOT/.htpasswd
Require valid-user
</Location>
Apache directory authentication
Use a Location block to protect a specific application directory.

Save the changes and restart Apache when editing httpd.conf. Changes in .htaccess take effect immediately because the file is read on every request.

Apache authentication prompt
Users are prompted to authenticate before opening the protected resource.

Security through Access Criteria

Apache access can be controlled according to criteria such as a client hostname or IP address by using the Require directive.

RequireAllNo contained directive may fail, and at least one must succeed.
RequireAnyAt least one contained authorization directive must succeed.
RequireNoneNone of the contained directives may succeed.

Open /etc/httpd/conf/httpd.conf or a target directory’s .htaccess file and add the required policy to the corresponding Directory section.

Apache access criteria
Set access criteria through the Require directive.
Apache complex access policy
Combine several conditions to create a more detailed access policy.
Public IP requirement: Denying access by client IP is meaningful only when the environment uses the Public IP feature.

Configure ModSecurity

ModSecurity provides filtering, URL and Unicode validation, auditing, null-byte attack prevention, upload-memory limits, server-identity masking, chroot support, and other security capabilities.

The module is available by default and is configured through:

/etc/httpd/conf.d/mod_security.conf
Apache ModSecurity configuration
Edit the default ModSecurity configuration or add custom settings.

Additional rule files can be uploaded to /etc/httpd/modsecurity.d or its activated_rules subdirectory. The default configuration loads them automatically:

Include modsecurity.d/*.conf
Include modsecurity.d/activated_rules/*.conf
Apache ModSecurity rules
Upload additional ModSecurity rule files to the configured rules directory.

Hide the Apache Server Version

Exposing the Apache, operating system, or module version can help an attacker identify applicable exploits. The platform adds these directives automatically:

ServerSignature Off
ServerTokens Prod
  • ServerSignature Off prevents Apache version details from appearing on server-generated pages.
  • ServerTokens Prod limits the HTTP response header to Server: Apache.

Expected Result

The Apache-hosted PHP application can require authentication, enforce hostname or IP-based access policies, use ModSecurity rules, and hide detailed server-version information.

Important Notes

  • Restart Apache after changing httpd.conf.
  • .htaccess changes take effect immediately when allowed by AllowOverride.
  • Use HTTPS with Basic authentication so credentials are encrypted in transit.
  • Test access policies from both allowed and denied clients.
  • Validate custom ModSecurity rules before production use.

What’s Next?