---
title: "How to Find & Fix Apache Scorecard Configurations"
source: "https://docs.nexcess.com/hosting/server-administration/linux/apache-web-server/how-to-find-fix-apache-scorecard-configurations/"
description: "Apache Scorecard helps optimize and secure servers via best practices for headers, SSL, performance, and version control. Test, fix, and recheck."
vertical: "Hosting"
date: "2025-05-21"
last_modified: "2026-07-29"
---

# How to Find & Fix Apache Scorecard Configurations

Apache Scorecard configurations are an essential part of optimizing and securing your Apache HTTP Server. These settings help assess your server’s configuration against best practices for performance, security, and reliability. This guide will walk you through how to **find** and **fix** Apache Scorecard issues to improve your web hosting environment.

## **What Are Apache Scorecard Configurations?**

While “Apache Scorecard” is not an official Apache term, it’s commonly used in DevOps and hosting communities to refer to a set of criteria or benchmarks used to evaluate an Apache server’s setup. These often include:

- Security headers (e.g., X-Content-Type-Options, Strict-Transport-Security)
- SSL/TLS configuration
- Directory and file permissions
- Performance settings like KeepAlive, Timeout, and caching
- Server version exposure
- Module usage and hardening

## **1. Check Your Apache Configuration**

Apache’s configuration files are usually located in:

- /etc/httpd/ (Red Hat/CentOS)
- /etc/apache2/ (Ubuntu/Debian)

To locate your active configuration files:

```
apachectl -V | grep SERVER_CONFIG_FILE
```

You can inspect the main file and any included files by looking for Include or IncludeOptional directives.

## **2. Run a Configuration Test**

Before making changes, check your current setup:

```
apachectl configtest
```

This command verifies syntax but not performance or security. Use it before restarting the server after any changes.

## **3. Use Security and Performance Testing Tools**

To evaluate your server’s scorecard, use external tools:

- [**SSL Labs SSL Test**](https://www.ssllabs.com/ssltest/) – Checks your HTTPS configuration.
- [**Mozilla Observatory**](https://observatory.mozilla.org/) – Grades your HTTP response headers and TLS setup.
- **[SecurityHeaders.com](http://securityheaders.com)** – Gives a quick overview of security-related headers.
- **[GTmetrix](https://gtmetrix.com/)** – Analyzes performance and caching settings.

These tools highlight weaknesses in your configuration and offer practical suggestions for improvement.

## **4. Fix Common Scorecard Issues**

### **Security Headers**

Add the following headers in your Apache config or .htaccess file:

```
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-XSS-Protection "1; mode=block"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Referrer-Policy "no-referrer-when-downgrade"
```

Enable mod\_headers if not already:

```
a2enmod headers  # Debian/Ubuntu
```

### **Disable Server Version Exposure**

Hide Apache version info to prevent targeted exploits:

```
ServerSignature Off
ServerTokens Prod
```

### **Optimize Performance Settings**

```
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5
```

Enable compression:

```
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
```

Enable caching (mod\_expires):

```
ExpiresActive On
ExpiresByType image/jpg "access plus 1 year"
ExpiresByType text/css "access plus 1 month"
ExpiresByType application/javascript "access plus 1 month"
```

### **Harden SSL/TLS**

Ensure mod\_ssl is enabled, and update your virtual host configuration:

```
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite HIGH:!aNULL:!MD5:!3DES
SSLHonorCipherOrder on
```

Use a modern TLS certificate from a trusted CA (e.g., Let’s Encrypt).

## **5. Restart Apache and Re-Test**

Once changes are made:

```
systemctl restart apache2  # Debian/Ubuntu
# or
systemctl restart httpd    # CentOS/RedHat
```

Then, re-run the external tests to verify improvements.

---

## **Summary**

Apache Scorecard configurations are crucial for securing and optimizing your web server. By checking headers, SSL/TLS, performance tuning, and version obfuscation, you can significantly enhance your site’s resilience and responsiveness.

Need more help? Reach out to our [support team](https://www.liquidweb.com/support).