How to Find & Fix Apache Scorecard Configurations

Apache Scorecard configurations are an essential part of optimizing and securing your Apache HTTP Server. These settings help assess your server’s configuration against best practices for performance, security, and reliability. This guide will walk you through how to find and fix Apache Scorecard issues to improve your web hosting environment.

What Are Apache Scorecard Configurations?

While “Apache Scorecard” is not an official Apache term, it’s commonly used in DevOps and hosting communities to refer to a set of criteria or benchmarks used to evaluate an Apache server’s setup. These often include:

• Security headers (e.g., X-Content-Type-Options, Strict-Transport-Security)
• SSL/TLS configuration
• Directory and file permissions
• Performance settings like KeepAlive, Timeout, and caching
• Server version exposure
• Module usage and hardening

1. Check Your Apache Configuration

Apache’s configuration files are usually located in:

• /etc/httpd/ (Red Hat/CentOS)
• /etc/apache2/ (Ubuntu/Debian)

To locate your active configuration files:

apachectl -V | grep SERVER_CONFIG_FILE

You can inspect the main file and any included files by looking for Include or IncludeOptional directives.

2. Run a Configuration Test

Before making changes, check your current setup:

apachectl configtest

This command verifies syntax but not performance or security. Use it before restarting the server after any changes.

3. Use Security and Performance Testing Tools

To evaluate your server’s scorecard, use external tools:

• SSL Labs SSL Test – Checks your HTTPS configuration.
• Mozilla Observatory – Grades your HTTP response headers and TLS setup.
• SecurityHeaders.com – Gives a quick overview of security-related headers.
• GTmetrix – Analyzes performance and caching settings.

These tools highlight weaknesses in your configuration and offer practical suggestions for improvement.

4. Fix Common Scorecard Issues

Security Headers

Add the following headers in your Apache config or .htaccess file:

Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-XSS-Protection "1; mode=block"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Referrer-Policy "no-referrer-when-downgrade"

Enable mod_headers if not already:

a2enmod headers  # Debian/Ubuntu

Disable Server Version Exposure

Hide Apache version info to prevent targeted exploits:

ServerSignature Off
ServerTokens Prod

Optimize Performance Settings

KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5

Enable compression:

AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript

Enable caching (mod_expires):

ExpiresActive On
ExpiresByType image/jpg "access plus 1 year"
ExpiresByType text/css "access plus 1 month"
ExpiresByType application/javascript "access plus 1 month"

Harden SSL/TLS

Ensure mod_ssl is enabled, and update your virtual host configuration:

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite HIGH:!aNULL:!MD5:!3DES
SSLHonorCipherOrder on

Use a modern TLS certificate from a trusted CA (e.g., Let’s Encrypt).

5. Restart Apache and Re-Test

Once changes are made:

systemctl restart apache2  # Debian/Ubuntu
# or
systemctl restart httpd    # CentOS/RedHat

Then, re-run the external tests to verify improvements.

Summary

Apache Scorecard configurations are crucial for securing and optimizing your web server. By checking headers, SSL/TLS, performance tuning, and version obfuscation, you can significantly enhance your site’s resilience and responsiveness.

Need more help? Reach out to our support team.