Problem solve Get help with specific problems with your technologies, process and projects.

Protecting the Web server

SearchSecurity's expert Stephen Mencik helps you protect your Web servers in this Web Security Tip

Protecting the Web server
By Stephen Mencik

SearchSecurity site expert Stephen Mencik offers his advice for securing a Web server in this Ask the Expert Q&A.

Q: How can we protect our Web server from external attack?

There are a number of things you can do to protect yourself against external attacks.

First, the Web server should have only those services running that are absolutely needed.

Second, the operating system and applications should all have the most recent security patches installed. The OS should be "hardened" as much as possible. A paper that is OpenBSD centric, but has some application to hardening all operating systems, can be found at

Third, it should sit behind a firewall that only allows those ports needed for operation. For example, if it is purely a Web server that does not need any access from the outside other than via http and https, then only ports 80 and 443 need to be open. However, if you are running a Web hosting company, your clients need to be able to upload files and more. So you'll probably need to enable the ports for FTP and Telnet. If you are combining this with e-mail services, you'll need to open the ports for POP and SMTP, or whatever protocols you use for mail. (For more information on ports, go to

Fourth, all form input should be validated by the script that handles the form. Buffer overflows are a favorite type of attack. A good reference for CGI script security is located at

Fifth, make use of audit logs. Use TCP Wrappers where you can.

Sixth, make regular backups. Even the best security planning is not perfect. Someone still might find a way to break in. And even if there is no security break-in, you might lose a hard drive. So, you still want to have regular backups.

Essentially, you want to do everything you can think of to improve the security of the machine. You can do some Web searches for security information on your particular combination of OS and Web server application and find lots of good advice on the best things to do to make the server as secure as possible.


Talk back! Do you have any comments on this tip? If so, share them in our Sound Off discussion forum.

Stephen Mencik has answered dozens of Web and network related questions from your peers. Peruse the archive of Q&As, or submit a question of your own.

Do you have a tip for securing a Web server? Submit it to searchSecurity and you could win a prize. While you're at it, vote on the tips your peers have submitted.

Related Book

Administrating Web servers, security and maintenance
By Eric Larson & Brian Stephens
Publisher Name: Prentice Hall
Date published: Dec. 1999
Pages: 350
Cover Type: Soft Cover
This book is designed to provide individuals with the core skills needed to meet the demands of the Web development and Internet community. This user-friendly interactive text provides competency in three key skill areas: 1. Web Business Management, from financial issues to project management and marketing. 2. Content Management, including user interface, authoring languages, multimedia and graphics. 3. Technical Management involving administration, protocols, performance and security.

This was last published in September 2001

Dig Deeper on Web Server Threats and Countermeasures

Start the conversation

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.