Web Server
Security Reviews
Configuration-level security assessment of Apache, Nginx, Microsoft IIS and Apache Tomcat — hardening the servers that expose your applications to the internet before an attacker finds the gaps.
The web server is the single most exposed component in most technology estates. It terminates untrusted traffic from the internet, brokers access to application code and back-end data, and is very often deployed from a vendor default configuration that was never intended for production use. Verbose error pages, permissive directory handling, legacy TLS ciphers, unnecessary modules, and over-privileged service accounts are routine findings even in mature environments.
A web application penetration test tells you whether your application code is secure. A web server configuration review tells you whether the platform underneath it is. The two are complementary, and weaknesses at the server layer frequently undermine otherwise well-written applications — request smuggling through a misconfigured reverse proxy, source code disclosure through a mishandled file extension, or full host compromise via an exposed management interface.
Levantis Cyber reviews web servers including Apache HTTP Server, Nginx (open source and Plus), Microsoft IIS and Apache Tomcat, against security best practices including CIS benchmarks, DISA STIG, vendor hardening guidance, and — critically — against how our operators actually attack these platforms in live engagements.
Scope, Baseline & Configuration Capture
We agree the in-scope servers, roles (edge, reverse proxy, origin, application container) and applicable baselines. Configuration is captured directly — httpd.conf and included vhosts, nginx.conf and site definitions, IIS applicationHost.config and per-site web.config, Tomcat server.xml, context.xml and web.xml — alongside module lists, patch level, and service account context.
Platform Hardening & Module Assessment
Systematic review of the server build against security benchmarks and vendor guidance. We assess loaded modules and handlers for unnecessary attack surface (WebDAV, autoindex, status endpoints, mod_userdir, IIS ISAPI filters), verify the server runs as a least-privileged non-interactive account, review filesystem permissions on document roots and configuration files, and check that the server version and patch level are current and not disclosed in responses.
TLS & Transport Security Review
Assessment of certificate validity, chain construction, key strength, and expiry management. We review enabled protocol versions and cipher suites, forward secrecy, OCSP stapling, HSTS policy and preload status, session resumption configuration, and TLS renegotiation behaviour. Mixed-content and plaintext listener exposure are identified, and redirect enforcement from HTTP to HTTPS is verified across all virtual hosts.
Virtual Host, Routing & Reverse Proxy Analysis
Review of virtual host and server block definitions for default-host fallthrough, host header handling, and unintended site exposure. Reverse proxy and load balancer configurations are examined for request smuggling exposure arising from Content-Length and Transfer-Encoding handling inconsistencies, header normalisation gaps, path traversal via unnormalised proxy_pass definitions, and trust of client-supplied forwarding headers.
Content Handling & Information Disclosure
Testing for directory listing, backup and editor artefact exposure, source code disclosure via alternate extensions or case handling, and access to version control metadata. We review error page configuration for stack trace and path leakage, assess MIME type and handler mappings for dangerous execution paths, and verify that upload directories cannot execute server-side code.
Management Interface & Authentication Controls
Particular attention is given to administrative surfaces — the Tomcat Manager and Host Manager applications, IIS remote management, Nginx status endpoints, and Apache server-status / server-info. We assess whether these are network-restricted, whether default or weak credentials remain in place, and whether they present an authenticated path to arbitrary code execution on the host.
Security Headers, Logging & Resilience
Review of response security headers — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy — for presence and correctness rather than mere existence. We assess access and error log configuration for forensic sufficiency and protection, and review request limits, timeouts, and rate controls that mitigate resource exhaustion.
Reporting & Remediation Guidance
A detailed technical report with every finding risk-rated by real-world exploitability, accompanied by platform-specific configuration snippets your engineers can apply directly. An executive summary is provided for senior stakeholders, and a debrief call with your infrastructure and application teams is included as standard.
Most web server reviews are a scanner report with a CIS benchmark stapled to the front. Ours are not. Our operators have compromised production estates through exactly these misconfigurations — an exposed Tomcat Manager with default credentials, a reverse proxy that could be desynchronised, a virtual host that served .git to the internet. We assess configuration through that lens, and we prioritise findings by what an attacker would actually reach for first.
Every recommendation arrives as working configuration, not prose. If we tell you your cipher suite ordering is wrong, you get the corrected directive block for your specific server version. That difference is what turns a report into remediated infrastructure.