Top 10 Web Server Misconfigurations That Hackers Love

1. Directory Listing Enabled Critical

When directory listing is enabled, visitors can see all files in a directory if no index file is present.

How Attackers Exploit It:

• Discover sensitive files (backups, config files)
• Find hidden pages and endpoints
• Download source code

How to Fix:

# Apache
Options -Indexes

# Nginx
autoindex off;

# IIS

2. Default Credentials Critical

Using unchanged default usernames and passwords for admin interfaces, databases, or applications.

How Attackers Exploit It:

• Brute-force attacks using common defaults
• Access admin panels and sensitive data
• Complete server takeover

How to Fix:

• Change all default credentials immediately after installation
• Use strong, unique passwords
• Implement multi-factor authentication

3. Unnecessary HTTP Methods High

Allowing dangerous HTTP methods like PUT, DELETE, TRACE, or CONNECT.

How Attackers Exploit It:

• Upload malicious files (PUT)
• Delete critical files (DELETE)
• Cross-site tracing attacks (TRACE)

How to Fix:

# Apache

    Deny from all


# Nginx
if ($request_method !~ ^(GET|HEAD|POST)$ ) {
    return 405;
}

4. Verbose Error Messages High

Displaying detailed error messages to users that reveal system information.

How Attackers Exploit It:

• Gather intelligence about server architecture
• See database queries and schema details
• Discover file paths and system usernames

How to Fix:

# PHP
display_errors = Off
log_errors = On

# ASP.NET


# General
Configure generic error pages

5. Outdated Software Versions Critical

Running old, unpatched versions of web servers, frameworks, or plugins.

How Attackers Exploit It:

• Exploit known vulnerabilities
• Use public exploits against unpatched systems
• Gain easy access through fixed flaws

How to Fix:

• Implement a patch management process
• Subscribe to security bulletins for your software
• Use vulnerability scanners to detect outdated components

6. Improper File Permissions High

Setting incorrect permissions on files and directories (world-writable, wrong ownership).

How Attackers Exploit It:

• Modify critical files
• Upload malicious scripts
• Elevate privileges

How to Fix:

# Recommended permissions
find /var/www -type d -exec chmod 755 {} \;
find /var/www -type f -exec chmod 644 {} \;
chown -R www-data:www-data /var/www

7. Missing Security Headers Medium

Not implementing important HTTP security headers.

How Attackers Exploit It:

• Cross-site scripting attacks
• Clickjacking
• MIME sniffing attacks

How to Fix:

# Recommended headers
add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header Content-Security-Policy "default-src 'self'";

8. Unrestricted File Uploads Critical

Allowing file uploads without proper validation and restrictions.

How Attackers Exploit It:

• Upload web shells
• Execute malicious code
• Distribute malware

How to Fix:

• Validate file types by content, not extension
• Store uploads outside web root
• Use random filenames
• Scan uploads with antivirus

9. Unprotected Configuration Files Critical

Leaving configuration files (like .env, config.php) accessible via web.

How Attackers Exploit It:

• Steal database credentials
• Access API keys
• Discover internal infrastructure details

How to Fix:

# Block access to config files

    Require all denied


# Nginx
location ~ /\.env {
    deny all;
}

10. Unnecessary Services Enabled High

Running unused services (FTP, Telnet, old PHP versions) that increase attack surface.

How Attackers Exploit It:

• Exploit service-specific vulnerabilities
• Use as pivot points
• Brute-force weak service credentials

How to Fix:

# Identify running services
netstat -tulnp

# Disable unnecessary services
systemctl disable vsftpd
systemctl stop vsftpd