Is there a standard way of automatically testing the basic security of my web server? I've found a couple on-line services, (e.g. http://hackertarget.com/), and they seem ok, but I'd like to start off with the basics. Is there a go-to method for stress-testing a web server's security?
There are a number of scanners out there which aren't free. Like Nexpose or Nessus which can do way more than just scanning a webserver. But they provide this functionality as well of course.
The interesting part is that these scanners can also log into your server and perform configuration reviews to a certain standard. For instance the DISA STIG is a very good baseline to test against and see if you have properly implemented your webserver in a secure way.
Aside from that, you can also test the application itself, with automated scanners like Burp or Appscan.
Another option would be to use ASV. They are normally only used for PCI-DSS compliance, but you can also use them of course even if you needn't be compliant with PCI-DSS. Their baseline scans and reports are a very good baseline assessment to see what the level of security is, as the PCI-DSS requirements are not light at all.