79 Web Server Security Tips

Here are 79 tips to help you improve your web server security. I start with passwords as you would be surprised at the number of cases we handle that boil down to bad passwords. Web application security can also be improved with some simple steps and it is time everyone stop using insecure communication protocols. Check out the list and send in your tips to get up to 100.

Password Security

1. Use passwords with at least 8 characters.
2. Use complex passwords that include numbers, symbols, and punctuation.
3. Use a variety of passwords for different accounts or roles.
4. Test passwords in a secure password tool.
5. Do not use dictionary words as passwords, e.g. myblackdog
6. Do not repeat sequences of characters, e.g. 3333, abcdabcd.
7. Do not use personal information in passwords, e.g. your birthdate.
8. Do not store passwords on laptops, smartphones or tablets that can be lost.
9. Use a password manager to securely keep track of your passwords (See our post on LastPass).
10. Setup two-factor authentication when available.
11. Use a secure password generator.

Secure Communications

12. Use Secure FTP instead of plain FTP.
13. Use SSH instead of telnet.
14. Use Secure Email Connections (POP3S/IMAPS/SMTPS)
15. Secure all web administration areas with SSL (HTTPS).
16. Secure your web forms with SSL (HTTPS).
17. Use VPN when available.
18. Use firewalls on all endpoints, including servers and desktops.
19. Use residential/office firewall/IPS systems.
20. Encrypt highly sensitive emails.
21. Do not use public computers to access sensitive information.

Web Application Security

22. Sign up for notices about web application updates.
23. Update your web applications promptly.
24. Scan web applications using remote security tools such as Nessus.
25. Use a web application firewall.
26. Test file upload fields to assure code cannot be uploaded.
27. Have custom code reviewed for security issues.
28. Use coding frameworks with good security history.
29. Do not rely solely on obscure directory/file names for security.
30. Secure web application admin areas with IP based restrictions.
31. Sanitize user input.
32. Put sensitive files outside of document root or restrict access.
33. Avoiding using shell commands within scripts.
34. Don’t trust HTTP Referrer fields as they are easily forged.
35. Use POST instead of GET to submit data so sensitive information is not in the URL.
36. Validate data server-side not client-side.
37. Do no rely on relative file and path names. Always set base directories.
38. Specify permissions when creating files.
39. Limit file upload, creation activities to specific directories.
40. Create safe error messages by not disclosing sensitive information in errors.
41. Be careful of what data you trust from a cookie; it can be manipulated.
42. Encrypt configuration files that contain sensitive logins.
43. Guard against application level DOS attacks by limiting field input length.
44. Disable url fopen if possible.
45. Enable safe mode, include directory and open base restrictions if possible
46. Disable dangerous PHP functions if possible
47. Be careful of naming files *.bak, *.txt or *.inc within the web document root.
48. Be careful using version management tools on your doc root.
49. Set default reply-to’s for web applications and monitor the email for bounces.
50. Use version control systems.
51. Use bug tracking and change log systems

Server Security

52. Update your OS regularly – as in within hours of critical updates.
53. Update your control panel regularly.
54. Reduce information disclosure, e.g. changing ServerTokens in Apache.
55. Don’t install software that is not used.
56. Don’t store backups or old versions of software on the production system.
57. Restrict access to directories with proper permissions
58. Make sure logs are working properly.
59. Make sure you log all admin level accesses with date, times and usernames.
60. Make sure you use a firewall.
61. Remove default accounts in MySQL.
62. Disable direct root login in SSH.
63. Get rid of passwords with SSH keys.
64. Disable unused services.
65. Maintain backups.
66. Test backups.
67. Do not do development on production systems.
68. Stay updated with subscriptions to security notification services.
69. Monitor web traffic for unusual activity.
70. Conduct regular, remote security scans.
71. Conduct regular, local security scans.
72. Harden default service settings in Apache, SSH and other services.
73. Use root account only when required.
74. Use sudo to grant others root level access.
75. Enable SELinux if possible.
76. Use private networks for internal server traffic.
77. Use encryption when appropriate.
78. Conduct password audits.
79. Enforce strong passwords and change policies.