The Internet is an insecure space. Therefore we should keep an eye on our server—the logs tell us what we need to know, if we know where to look. Sometimes it is nice to have statistics. We can gather them easily with RRDtool and mod_rrdtool.

We can disallow access to certain areas of our site with mod_access, and mark out private space where only authenticated users can roam with mod_auth. By design, Lighttpd is quite capable of holding on in a Denial of Service or slashdotting. We can harden it further against such "attacks" by changing timeouts and limiting traffic, request sizes and HTTP sessions. Keeping an eye on our resource usage always helps.

Remember that none of the above will help us if we deploy an insecure web application through Lighttpd. The system is only as secure as its weakest part.