Step 1: SSH into the Apache server

ssh ubuntu@your-appache-server

Step 2: Enable required Apache modules

sudo a2enmod ssl rewrite headers socache_shmcb

Step 3: Install security packages

sudo apt update
sudo apt install -y libapache2-mod-security2 fail2ban certbot python3-certbot-apache modsecurity-crs

Step 4: Hide Apache version info

Edit the security config:

sudo nano /etc/apache2/conf-enabled/security.conf

Find and change these two lines:

Save and exit: Ctrl+O, Enter, Ctrl+X

Step 5: Enable ModSecurity WAF

sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
sudo nano /etc/modsecurity/modsecurity.conf

Find this line: SecRuleEngine DetectionOnly

Change it to: SecRuleEngine On

Save and exit: Ctrl+O, Enter, Ctrl+X

Step 6: Configure fail2ban

Create a local config:

sudo nano /etc/fail2ban/jail.local

Paste this configuration:

[apache-auth]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/apache2/error.log
maxretry = 3
bantime = 3600
[apache-badbots]
enabled = true
port = http,https
filter = apache-badbots
logpath = /var/log/apache2/access.log
maxretry = 2
bantime = 86400

Step 7: Restart services

sudo systemctl restart apache2
sudo systemctl enable fail2ban
sudo systemctl restart fail2ban

Step 8: Get SSL certificate

Replace yourdomain.com with your actual domain:

sudo certbot --apache -d yourdomain.com

Follow the prompts:

1. Enter email address
2. Agree to terms (Y)
3. Choose whether to share email (Y/N)
4. Select option to redirect HTTP to HTTPS (option 2)

Step 9: Verify the fixes

• Check Apache status: sudo systemctl status apache2
• Check server headers: curl -sI http://localhost | grep Server
• Check fail2ban: sudo fail2ban-client status
• Check ModSecurity: sudo apache2ctl -M | grep security
• Test SSL: curl -I https://yourdomain.com

Step 10: Exit the server

exit

Quick Reference Checklist