Apache Server 2.4 Windows STIG Checklist

19 items · Security · Hard difficulty · 2 hours

Harden Apache 2.4 on Windows with a DISA STIG-based checklist.

• Download official DISA Apache 2.4 Windows STIG package

  Get the standalone XCCDF and supporting resources from DISA.

• Inventory Apache installation and version

  Confirm installed Apache version (2.4.x) and installed modules.

• Backup Apache configuration and website content

  Export httpd.conf, SSL keys, vhosts, and site files before changes.

• Apply Windows OS security updates and patches

  Install latest supported security fixes before server hardening.

• Harden file and directory permissions for Apache service account

  Restrict write access to config and web directories to needed accounts.

• Configure Apache to run under a least-privilege user account

  Avoid running the service as Administrator or SYSTEM where possible.

• Disable unused Apache modules and handlers

  Comment out or remove LoadModule lines for unused modules.

• Configure directory controls to disable directory listing

  Set Options -Indexes and restrict FollowSymLinks where not required.

• Enable and enforce TLS with strong protocols and ciphers

  Serve sensitive content only over TLS and disable HTTP where possible.

• Install a valid server certificate and configure SSL certificate paths

  Configure SSLCertificateFile/SSLCertificateKeyFile with valid certs.

• Disable TLS 1.0/1.1 and weak ciphers; prefer TLS 1.2+

  Set SSLProtocol and SSLCipherSuite to modern, secure values.

• Configure HTTP to HTTPS redirection and HSTS

  Redirect HTTP to HTTPS and add Strict-Transport-Security header.

• Configure secure HTTP headers (HSTS, X-Frame-Options, CSP)

  Add headers to mitigate clickjacking, XSS, and mixed content risks.

• Restrict access to management interfaces and admin pages

  Limit by IP, VPN, or authentication and remove public exposure.

• Enforce authentication and authorization for protected resources

  Configure appropriate auth providers and least-privilege access.

• Enable and configure access and error logging with rotation

  Ensure logs capture client IPs, timestamps, and are rotated securely.

• Deploy and configure a web application firewall or mod_security rules

  Activate rule sets tailored to your application to block common attacks.

• Scan server with the STIG checklist or automated compliance tool and remediate findings

  Run the DISA checklist/XCCDF and address identified vulnerabilities.

• Document configuration changes and maintain compliance records

  Log changes, dates, and responsible personnel for audit and review.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.