In fact Debian ships Apache with a decent default setup which also allows further Debian packages to seamlessly hook into the configuration (with directories li

In fact Debian ships Apache with a decent default setup which also allows further Debian packages to seamlessly hook into the configuration (with directories likes /etc/apache2/conf.available and /etc/apache2/conf.enabled and softlinks inbetween). Apache itself does not have any "default" configuration at all, it most likely also starts fine with an empty configuration file. Of course "fixing" security problems at the level of the web server feels like adding a firewall to your server instead of avoiding daemons listening on public ports. It feels wrong. But it can be seen as another layer of security.