Skip to main content

Security

Fast servers still need layered defenses. OpenLiteSpeed gives you hooks for TLS, request filtering, WAF rules, and traffic shaping, but you need to configure them deliberately.

SSL / TLS​

Let's Encrypt Integration​

Let's Encrypt is the most common way to get trusted public certificates for browsers.

Certificate Installation​

After issuing a certificate, configure the listener or virtual host with the certificate file and matching private key.

TLS Configuration​

Disable outdated protocols, prefer modern ciphers, and keep HTTP redirected to HTTPS unless there is a strong legacy reason not to.

Auto Renewal​

Automate renewal with certbot or another ACME client, then reload OpenLiteSpeed after renewal if needed.

Access Control​

IP Restrictions​

Restrict sensitive paths such as admin tools, staging areas, and WebAdmin to known IPs whenever possible.

Hotlink controls reduce unauthorized embedding of your images or media on external sites.

Authentication​

Use authentication on protected paths, private downloads, and internal tools. Layer it with HTTPS so credentials are not exposed in transit.

Web Application Firewall​

ModSecurity Support​

OpenLiteSpeed supports ModSecurity rules to inspect and block malicious request patterns.

OWASP Rules​

The OWASP Core Rule Set is the usual starting point for broad protection against common web attacks.

Custom Rules​

Add custom exclusions or blocks for your application, but document them carefully so you do not hide real abuse.

DDoS Protection​

Connection Limits​

Limit the number of concurrent connections from one source or overall to avoid cheap resource exhaustion.

Request Limits​

Throttle bursts of expensive requests, especially to dynamic endpoints.

Bandwidth Throttling​

Bandwidth shaping helps protect server capacity during abusive transfers or very large downloads.

Security Baseline Checklist​

  • HTTPS enabled on every public site
  • Admin interfaces restricted by firewall or IP allowlist
  • ModSecurity tested before production enablement
  • Sensible connection and request limits in place
  • File permissions reviewed for vhost roots, config, and certificates