Web server security

Web servers are used to host projects that are accessed through Thin Clients (including Mobile Access). Even though some of these security recommendations have been mentioned elsewhere, here is a list of recommendations to keep your web server secure:

• Keep your operating system and web server up to date. Regularly install updates and security fixes.

• Remove or disable unnecessary modules. In most cases, the web server is only used to host project web applications like Mobile Access. Unused modules like PHP should be removed or disabled.

• Secure your web server with SSL Certificates, but only allow TLS 1.2 or above.

• Restrict web server access by IP address, or by a range of IP addresses.

• Enable logging on the web server, and monitor the logs.

• Enable web server specific security modules (for example, mod_security and mod_evasive on Apache, ModSecurity in NGINX, etc.).

• Follow the guidance provided by the web server vendor (for example, https://httpd.apache.org/docs/2.4/misc/security_tips.html, https://docs.nginx.com/nginx/admin-guide/security-controls/, etc.).