New answers tagged configuration
Is this a good use case of using Virtual Private Network? What's the best practice? It is a broad question and it depends on many factors (size of your team, user locations, network zones, location of DBs, internal network connections among hosts etc). To put it simply, you should be only exposing your production web server and your other hosts ...
Another common solution is to drop an index.php in each folder, with just a comment eg: silence is golden... Every WordPress installs like this. As @Pinoniq pointed out, this solution would assume index.php is specified as your index file preference. http://httpd.apache.org/docs/2.2/mod/mod_dir.html#directoryindex
Allowing Indexes doesn't only allow disabling them, it also allows quite a bit of other options which could increase the attack surface. Also, just setting AllowOverride to anything but None has a performance penalty as Apache now looks for .htaccess files in each directory of the requested file's path.
Before answering your question, I would like to define a word you used (hardening). According to the all-knowing wiki, I will define it as "the process of securing a system by reducing its surface of vulnerability." To know which approach is right for you, you have to know what you hope to achieve. Some in the DoD (and other industries) may only apply STIGs ...
Top 50 recent answers are included