SOAP with PHP : Create Web Service using SOAP by Example

SOAP is a wonderful technology that can help you in developing great applications. In this tutorial, we will investigate the use of SOAP in PHP.

Unless you have been living in a cave somewhere without Internet access for the last few years, you have undoubtedly heard of XML, SOAP and Multi-Tiered Application Programming. If you are like many programmers, including myself, you were quite taken aback by these ideas and technologies. You may have gone so far as to simply dismiss them as irrelevant to your skill set. It's time to wake up and realize they're here to stay... and for good reason!

XML and SOAP, and in turn Multi-Tiered Programming, are technologies that can take you from being a run of the mill code hacker to a professional application developer that actually builds cool things that work and which other people can work on. These technologies enable you to build applications that separate data from presentation, keep things organized and enable your application to scale as your needs and user base increases.

If you believe like I do that the Internet is the ultimate building ground of our future, then you have to see that the 'hackish' method in which most applications for the web are built and designed is pitiful. I know that I am quite guilty of it, myself. Many times I get an itch and I just scratch it without thinking of what the future holds or the maintainability of my application. Sure the job gets done; the itch has gone away momentarily. But when the itch comes back six months down the road and I have to add or modify features, I am utterly disappointed in myself over the sorry shape of my code.

You may be asking, how can XML and SOAP help me to avoid poor application design? Well, by themselves they won't help at all. First and foremost you must get yourself into the mind set that it needs to take place. XML and SOAP are just two tools that will allow you to accomplish your goal.

Define Our Goal

Today we will build a Web Service using SOAP. In doing so, I hope that you will become familiar with the technology so that you can start incorporating it into your future applications.

Before we get too much further along, let's make sure we are all on the same footing regarding the basic terminology that we will deal with in this tutorial.

XML: "XML is the Extensible Markup Language. It is designed to improve the functionality of the Web by providing more flexible and adaptable information identification." (http://www.ucc.ie/xml/#acro)%br%%br%In other words, XML is a method for describing your data. For the purpose of this tutorial, we will not be directly manipulating any XML. Instead, we will examine the XML resulting from our scripts. The libraries and protocols we will use through this tutorial will handle the XML manipulation for us.%br%%br%

SOAP: Simple Object Access Protocol. "SOAP is a lightweight protocol for exchange of information in a decentralized, distributed environment. It is an XML based protocol that consists of three parts: an envelope that defines a framework for describing what is in a message and how to process it, a set of encoding rules for expressing instances of application-defined datatypes, and a convention for representing remote procedure calls and responses." (http://www.w3.org/TR/2000/NOTE-SOAP-20000508/) is what you are here for. We will develop both a client and a server for our SOAP service. In this tutorial, we will be using the NuSOAP library. (http://dietrich.ganx4.com/nusoap/index.php)

WSDL: "WSDL is an XML format for describing network services as a set of endpoints operating on messages containing either document-oriented or procedure-oriented information." (http://www.w3.org/TR/wsdl) with XML, we will not be directly any WSDL documents. The wonderful NuSOAP library will generate WSDL documents for us. What you need to know about WSDL is that it is a document that describes a Web Service. It can tell a client how to interact with the Web Service and what interfaces that Web Service provides.

Client: We will define a Client as a script that uses a Web Service.

Server: Conversely, a Server will be defined as a script that provides a Web Service.

Today we are going to build a Web Service that will return a stock price given a particular stock symbol. This is a classic example of where Web Services are of great use.

You may be building an application that needs the data and could very easily just pull the data directly from your data source. Building a Web Service for it, however, allows you to give other applications easy access the same data in the future. It also separates the data extraction from the data source from the application itself. Say you were storing the data in a MySQL database but later decided to move it to a SQLite database... in this scenario your application wouldn't know the difference. Its calls to the Web Service remain unchanged.

To provide a stock quote service you will have to have the stock prices and symbols stored in some fashion or another. This tutorial is not going to concentrate on the storage mechanism or how to obtain the prices. I will simply provide you will a table schema and some sample data to work with.

CREATE TABLE `stockprices` ( `stock_id` INT UNSIGNED NOT NULL AUTO_INCREMENT , `stock_symbol` CHAR( 3 ) NOT NULL , `stock_price` DECIMAL(8,2) NOT NULL , PRIMARY KEY ( `stock_id` ) ); INSERT INTO `stockprices` VALUES (1, 'ABC', '75.00'); INSERT INTO `stockprices` VALUES (2, 'DEF', '45.00'); INSERT INTO `stockprices` VALUES (3, 'GHI', '12.00'); INSERT INTO `stockprices` VALUES (4, 'JKL', '34.00');

Create a SOAP server

The first thing we need to do is to create the SOAP server. This is the script that will fetch the data from the database and then deliver it to the Client. One wonderful thing about the NuSOAP library is that this same Server script will also create a WSDL document for us.

The first step is to create a function that will fetch the data we want. Create this function just as you would any other. It is just straight up PHP. The one trick is to name the function something sensible, as this will be the name that is used when the Client contacts the Server.

function getStockQuote($symbol) { mysql_connect('server','user','pass'); mysql_select_db('test'); $query = "SELECT stock_price FROM stockprices " . "WHERE stock_symbol = '$symbol'"; $result = mysql_query($query); $row = mysql_fetch_assoc($result); return $row['stock_price']; } ?>

Now, it is time to turn this function into a Web Service. Basically, all we have to do is include the NuSOAP library, instantiate the soap_server class and then register the function with the server. Let's go through it step by step, after which I will present the completed script.

The first thing necessary is to simply include the NuSOAP library.

require('nusoap.php');

Next, instantiate an instance of the soap_server class.

$server = new soap_server();

The next line is used to tell NuSOAP information for the WSDL document it is going to create for us. Specifically we specify the name of the server and the namespace, in that order.

$server->configureWSDL('stockserver', 'urn:stockquote');

Now, we register the function we created with the SOAP server. We pass several different parameters to the register method.

The first is the name of the function we are registering.

The next parameter specifies the input parameters to the function we are registering. Notice that it is an array. The keys of the array represent the names of the input parameters, while the value specifies the type of the input parameter. One thing that pure PHP programmers might find odd is that I had to specify what types my input and return parameters are with the designations of xsd:string and xsd:decimal. It is required that you describe your data properly. You are not dealing with a loosely typed language here.

The third parameter to the register method specifies the return type of the registered function. As shown below, it is fashioned in the same way as the last parameter, as an array.

The next two parameters specify the namespace we are operating in, and the SOAPAction. For more information on the SOAPAction see http://www.oreillynet.com/pub/wlg/2331.

$server->register("getStockQuote", array('symbol' => 'xsd:string'), array('return' => 'xsd:decimal'), 'urn:stockquote', 'urn:stockquote#getStockQuote');

Now, we finally finish it off with two more lines of code. The first simply checks if $HTTP_RAW_POST_DATA is initialized. If it is not, it initializes it with an empty string. The next line actually calls the service. The web request is passed to the service from the $HTTP_RAW_POST_DATA variable and all the magic behind the scenes takes place.

$HTTP_RAW_POST_DATA = isset($HTTP_RAW_POST_DATA) ? $HTTP_RAW_POST_DATA : ''; $server->service($HTTP_RAW_POST_DATA);

Here is the completed server script which I have saved in a file named stockserver.php.

function getStockQuote($symbol) { mysql_connect('server','user','pass'); mysql_select_db('test'); $query = "SELECT stock_price FROM stockprices " . "WHERE stock_symbol = '$symbol'"; $result = mysql_query($query); $row = mysql_fetch_assoc($result); return $row['stock_price']; } require('nusoap.php'); $server = new soap_server(); $server->configureWSDL('stockserver', 'urn:stockquote'); $server->register("getStockQuote", array('symbol' => 'xsd:string'), array('return' => 'xsd:decimal'), 'urn:stockquote', 'urn:stockquote#getStockQuote'); $HTTP_RAW_POST_DATA = isset($HTTP_RAW_POST_DATA) ? $HTTP_RAW_POST_DATA : ''; $server->service($HTTP_RAW_POST_DATA); ?>

The WSDL Document

At this point you have a fully functioning SOAP Server. Clients can connect to it and request data. If you haven't done so already, bring up the script in your browser and see what you get. You should get a page giving you a link to the WSDL document for the Server. Click on it and you should see the resulting WSDL document. Surprise, surprise, it is in XML! If you read over this document, you will see that it describes what happens for a request and as a response for your particular SOAP Service.

Note that while it is possible to create a SOAP Server without having it create the WSDL file, I recommend creating the WSDL document anyway. It is simple enough, so why not?

Creating a SOAP Client

Creating a SOAP Client to access our Server with is just as simple as creating the Server was. Understand though that the Client does not necessarily need to be a PHP Client. The SOAP Server we just created can be connected to by any type of Client, whether that be Java, C#, C++, etc.

To create the SOAP Client, all we need to do are three things.

First, include the NuSOAP library. This is done just as it was for the Server.

require_once('nusoap.php');

Secondly, we need to instantiate the soapclient class. We pass in the URL of the SOAP Server we are dealing with.

$c = new soapclient('http://localhost/stockserver.php');

Last make a call to the Web Service. The one caveat is that the parameters to the Web Service must be encapsulated in an array in which the keys are the names defined for the service. You will see that I have an array key named 'symbol' because that is the name of the input parameter of my function. If you remember how we specified the input parameters when we registered the function with the server, you will see that this is very similar.

$stockprice = $c->call('getStockQuote', array('symbol' => 'ABC'));

Now, here is the completed Client script, which I have saved in a file named stockclient.php.

require_once('nusoap.php'); $c = new soapclient('http://localhost/stockserver.php'); $stockprice = $c->call('getStockQuote', array('symbol' => 'ABC')); echo "The stock price for 'ABC' is $stockprice."; ?> ?>

Creating a SOAP Client to access our Server with is just as simple as creating the Server was. Understand though that the Client does not necessarily need to be a PHP Client. The SOAP Server we just created can be connected to by any type of Client, whether that be Java, C#, C++, etc.

To create the SOAP Client, all we need to do are three things.

First, include the NuSOAP library. This is done just as it was for the Server.

require_once('nusoap.php');

Secondly, we need to instantiate the soapclient class. We pass in the URL of the SOAP Server we are dealing with.

$c = new soapclient('http://localhost/stockserver.php');

Last make a call to the Web Service. The one caveat is that the parameters to the Web Service must be encapsulated in an array in which the keys are the names defined for the service. You will see that I have an array key named 'symbol' because that is the name of the input parameter of my function. If you remember how we specified the input parameters when we registered the function with the server, you will see that this is very similar.

$stockprice = $c->call('getStockQuote', array('symbol' => 'ABC'));

Now, here is the completed Client script, which I have saved in a file named stockclient.php.

require_once('nusoap.php'); $c = new soapclient('http://localhost/stockserver.php'); $stockprice = $c->call('getStockQuote', array('symbol' => 'ABC')); echo "The stock price for 'ABC' is $stockprice."; ?> ?>

There it is. It really is that simple.

Conclusion

Hopefully after reading through this tutorial you have an understanding of how simple it is to create a SOAP Server and Client with NuSOAP. It simply astonished me how utterly simple it was after I actually took a look at it! Before I ever laid eyes on it I had dreams of a complex system that would take months to utilize. Luckily, NuSOAP came along and made that task simpler than anyone could ever ask for.

As you can see, SOAP is a wonderful tool for separating your application into smaller more manageable pieces. Do realize that SOAP isn't the cure all for everything. Its overuse is just as bad as any other poor design. The key to a good application design is patience and planning. Sit down, take out the old pencil and paper and write things down. Understand what you are really getting yourself into and ask lots of 'What If' questions. Think about the future of the application and ask yourself about the different ways it may be used in the future. The number one pitfall of application design is painting yourself into a corner. If you just thought about it ahead of time you could have started at the other side of the room.

AdSense Secret - How to choose the best keywords for adSense

Ever wondered how to select the best keywords for your Adsense websites? Your focus is earning money as well as attracting organic traffic towards your website. Here is what you need to know while choosing a keyword, a scientific study that maps the ideal keywords for your next upcoming adsense website.

We shall first study how to choose keywords that lead to more Adsense money.

CPC - Advantages and Drawbacks

What does CPC indicate?

When we think of high paying keywords, the first thing that pops up in our mind is CPC. CPC (Cost Per Click) is the maximum amount of money an advertiser is willing to pay for a click. Higher the CPC of a particular keyword, more will be the payouts you can expect by targeting that keyword in your AdSense websites. You can get the most accurate CPC from the source itself - Google.

However, CPC is not the only factor that tells the profitability of a keyword. There are many other factors that you should consider.

Drawbacks of CPC

- What if there are no advertisers bidding on a keyword having high CPC? Obviously, it means no one is going to pay you that high for a click.
- What if the traffic on the keyword is technical enough and does not click on ads (banner blindness)?
- What if Google gets loads of traffic on that keyword, enough to fulfill the desires of high paying advertisers? In this case, Google will only throw remaining peanuts towards you.

Obviously, Google will like to keep all the high paying ads within its own pages. So you see, CPC just shows you a small part of the entire picture. We shall explore the rest part of the picture...

Number of Sponsors - The Most Important Figure

Keywords with high CPC do not always come with high number of advertisers. There are many keywords in Google's Adwords system that have a high price, but almost no or very less number of advertisers. Now, if you build a web page or website around a keyword on which no one is bidding, Google will try to fill the ad blocks with ads of the related keywords rather than the high paying keyword you were initially targeting. There is no guarantee that ads of the related keywords will be good converters. Therefore, there is every likelihood that your clicks will be passed through SmartPricing Filter, eventually resulting in lesser payouts.

Hence, it is important to see the number of sponsors bidding on the keyword in question. If there are more the advertisers, there will be more competition among them to get the top position. This means that there will be more revenue per click that they are willing to share with you. In other words, more sponsors mean more people fighting against one another other to pay you more Adsense money.

Number of clicks on an Ad

It refers to the number of clicks an advertiser gets when his ad appears on the top. If the number of clicks and number of advertisers is less, just ignore those keywords, no matter what their CPC is. However, if the clicks per month are lower than expected, but the number of advertisers is a good one - it's the right choice for you. Such keywords are called "Niche AdSense' keywords." Here the word 'niche' is used in commercial context. This means that Google is not able to generate traffic on such keyword ads. This makes it difficult for it to exhaust the advertising budgets of the advertisers. Therefore, in order to meet its targets, Google happily shares high paying ads with you, resulting in more payouts. Try to find such "Niche AdSense' keywords."

Coming to Higher number of clicks - It indicates:

Either the traffic segment is ignorant about the online advertising concepts, and click on these ads unknowingly. This means you will experience higher CTR on your ads when placed at appropriate place. You don't have to put in much efforts to fight banner blindness.

Or, the traffic is highly commercial and willing to purchase the advertised product over internet. This means that there are very little chances of your facing the SmartPricing phenomenon.

Number of clicks along with the other stats like Number of sponsors and CPC, can enable you to make more wise decisions while choosing keywords for your AdSense content.

Bidding Quality

It's important to see the pattern in which people are bidding on a keyword. Suppose there are 400 advertisers bidding on a keyword. The top 20 of these are paying something like $15 per click, while the rest of them pay somewhere between $2 and $0.05. Now you might have found some decent tools that give you the average of top 3 or top 5 positions which is good, but not good enough. The point is that although the top 20 advertisers are paying higher, but the rest 380 advertisers are paying quite low. There is a high probability of your getting the ads of those 380 sponsors. Therefore, the average of the top 20 advertises can be really misleading. The solution to this problem is discussed in the later part of this page.

We have enough Adsense money now. Let's build some traffic on your website.

Traffic Building for AdSense:

Choosing Niche Keywords

Niche keywords are the keywords that are highly searched by the web surfers, and are rarely used by your competitors. Less competition means more traffic to your website. Targeting ten niche keywords is easier and more fruitful that targeting a highly competitive keyword. Traffic from niche keywords when directed to a relevant page increases your CTR and conversion ratio.

Determining Competition

People generally take the number of results returned by search engines as the number of pages competing on a keyword. But it is wrong. The Search Engine Results get irrelevant after 10 - 15 pages. Irrelevancy further increases with the depth. The pages that have the keyword dumped in a corner are not competing against you, but search engines will still list them. In fact they have to.

It is assumed that if a webmaster is targeting a web page with a particular keyword, the keyword is used in the title as well as in the anchor text linking to that webpage. Such a page is listed higher by the search engines as it is dedicated to what you searched for. So how to filter out the most relevant results? Check it out!

Inanchor intitle and Its Precision - The Solution

In Google, you can easily determine the EXACT number of pages that are competing against you. You can precisely list out the pages that are using a particular keyword in their page titles or in the anchor texts linking to them.

The query can be applied as follows: intitle:keyword inanchor:keyword.

For example, if the keyword is "hair treatment", the formula will be used in the following manner: intitle:hair inanchor: hair intitle: treatment inanchor: treatment. This figure gives you the exact number of pages that are ACTUALLY Targeting with these keywords, and not those that have just created a page or a small paragraph on the same topic. Google emphasizes on Anchors and Page titles. That's the reason, it supports such a search query.

We shall now discuss some other traditional ways to determine competition.

R/S Ratio

Here, R refers the number of competitor websites for a particular keyword as per the search result of the search engine. And S refers the number of searchers using that keyword while searching their queries. This means that for better results, you have to choose the keywords with lower R/S ratio.

R/S ratio becomes polluted when someone uses the number of results as the number of competing websites. As explained above, counting the number of results as the number of competing pages is the biggest mistake one can make while choosing a keyword. However, the figure becomes quite useful when inanchor intitle is used to create R/S.

KEI Analysis

KEI (Keyword Effectiveness Index) is a formula for measuring the effectiveness of a keyword. The formula was devised by Sumantra Roy. However, this figure also depends upon the number of searches and competition, but with a difference. This formula analyzes the number of searches and competition in such a way that if the searches increase, KEI increases; and if the competition increases, KEI decreases. Higher the KEI, more profitable will be the keyword. However, it becomes polluted when the number of search results are used as the number of competitors.

Determining Traffic

Determining traffic for a keyword is quite important before targeting it. Along with the competition stats, it lets you make out the niches present in any industry. Besides, it lets you predict (to some extent) how much traffic you can expect if you promote a website around a particular keyword. There are two known sources for determining traffic. Overture Keyword Suggestion Tool (now a part of Yahoo Search Engine) and WordTracker. When talking about accuracy, Wordtracker monitors the queries on some meta search engines that actually render it inaccurate . Reason? There is no known stat about how much of the community you are targeting is searching on those meta search engines. However, it's a good tool to make out the niches.

In my opinion, Yahoo owned Overture gives you more accurate stats than Wordtracker. This is for the reason that Overture is a PPC engine. It can show you how many people are searching for a particular term on its vast network. A network which is bigger than any Meta Search Engine. Still, it is not that accurate, but at least better than Wordtracker. The tools that are predicting Google Searches for you are just doing guess work. No one knows the algorithm they use.

Summing It Up

Profitability of a keyword depends more on the number of sponsors than CPC. Number of clicks and bidding quality can't be determined by just monitoring the first 3 or 8 places. It can be rightly assessed by taking out the average of all the 400 sponsors bidding on a keyword. Sounds very tiring for keyword research, right?

20 ways to Secure your Apache Configuration

Here are 20 things you can do to make your apache configuration more secure.

Disclaimer: The thing about security is that there are no guarantees or absolutes. These suggestions should make your server a bit tighter, but don't think your server is necessarily secure after following these suggestions.

Additionally some of these suggestions may decrease performance, or cause problems due to your environment. It is up to you to determine if any of the changes I suggest are not compatible with your requirements. In other words proceed at your own risk.

First, make sure you've installed latest security patches

There is no sense in putting locks on the windows, if your door is wide open. As such, if you're not patched up there isn't really much point in continuing any longer on this list. Go ahead and bookmark this page so you can come back later, and patch your server.

Hide the Apache Version number, and other sensitive information.

By default many Apache installations tell the world what version of Apache you're running, what operating system/version you're running, and even what Apache Modules are installed on the server. Attackers can use this information to their advantage when performing an attack. It also sends the message that you have left most defaults alone.

There are two directives that you need to add, or edit in your httpd.conf file:

ServerSignature Off
ServerTokens Prod

The ServerSignature appears on the bottom of pages generated by apache such as 404 pages, directory listings, etc.

The ServerTokens directive is used to determine what Apache will put in the Server HTTP response header. By setting it to Prod it sets the HTTP response header as follows:

Server: Apache

If you're super paranoid you could change this to something other than "Apache" by editing the source code, or by using mod_security (see below).

Make sure apache is running under its own user account and group

Several apache installations have it run as the user nobody. So suppose both Apache, and your mail server were running as nobody an attack through Apache may allow the mail server to also be compromised, and vise versa.

User apache
Group apache

Ensure that files outside the web root are not served

We don't want apache to be able to access any files out side of its web root. So assuming all your web sites are placed under one directory (we will call this /web), you would set it up as follows:

Order Deny,Allow
Deny from all
Options None
AllowOverride None


Order Allow,Deny
Allow from all

Note that because we set Options None and AllowOverride None this will turn off all options and overrides for the server. You now have to add them explicitly for each directory that requires an Option or Override.

Turn off directory browsing

You can do this with an Options directive inside a Directory tag. Set Options to either None or -Indexes

Options -Indexes

Turn off server side includes

This is also done with the Options directive inside a Directory tag. Set Options to either None or -Includes

Options -Includes

Turn off CGI execution

If you're not using CGI turn it off with the Options directive inside a Directory tag. Set Options to either None or -ExecCGI

Options -ExecCGI

Don't allow apache to follow symbolic links

This can again can be done using the Options directive inside a Directory tag. Set Options to either None or -FollowSymLinks

Options -FollowSymLinks

Turning off multiple Options

If you want to turn off all Options simply use:

Options None

If you only want to turn off some separate each option with a space in your Options directive:

Options -ExecCGI -FollowSymLinks -Indexes

Turn off support for .htaccess files

This is done in a Directory tag but with the AllowOverride directive. Set it to None.

AllowOverride None

If you require Overrides ensure that they cannot be downloaded, and/or change the name to something other than .htaccess. For example we could change it to .httpdoverride, and block all files that start with .ht from being downloaded as follows:

AccessFileName .httpdoverride

  Order allow,deny
  Deny from all
  Satisfy All

Run mod_security

mod_security is a super handy Apache module written by Ivan Ristic, the author of Apache Security from O'Reilly press.

You can do the following with mod_security:

• Simple filtering
• Regular Expression based filtering
• URL Encoding Validation
• Unicode Encoding Validation
• Auditing
• Null byte attack prevention
• Upload memory limits
• Server identity masking
• Built in Chroot support
• And more

Disable any unnecessary modules

Apache typically comes with several modules installed. Go through the apache module documentation and learn what each module you have enabled actually does. Many times you will find that you don't need to have the said module enabled.

Look for lines in your httpd.conf that contain LoadModule. To disable the module you can typically just add a # at the beginning of the line. To search for modules run:

grep LoadModule httpd.conf

Here are some modules that are typically enabled but often not needed: mod_imap, mod_include, mod_info, mod_userdir, mod_status, mod_cgi, mod_autoindex.

Make sure only root has read access to apache's config and binaries

This can be done assuming your apache installation is located at /usr/local/apache as follows:

chown -R root:root /usr/local/apache
chmod -R o-rwx /usr/local/apache

Lower the Timeout value

By default the Timeout directive is set to 300 seconds. You can decrease help mitigate the potential effects of a denial of service attack.

Timeout 45

Limiting large requests

Apache has several directives that allow you to limit the size of a request, this can also be useful for mitigating the effects of a denial of service attack.

A good place to start is the LimitRequestBody directive. This directive is set to unlimited by default. If you are allowing file uploads of no larger than 1MB, you could set this setting to something like:

LimitRequestBody 1048576

If you're not allowing file uploads you can set it even smaller.

Some other directives to look at are LimitRequestFields, LimitRequestFieldSize and LimitRequestLine. These directives are set to a reasonable defaults for most servers, but you may want to tweak them to best fit your needs. See the documentation for more info.

Limiting the size of an XML Body

If you're running mod_dav (typically used with subversion) then you may want to limit the max size of an XML request body. The LimitXMLRequestBody directive is only available on Apache 2, and its default value is 1 million bytes (approx 1mb). Many tutorials will have you set this value to 0 which means files of any size may be uploaded, which may be necessary if you're using WebDAV to upload large files, but if you're simply using it for source control, you can probably get away with setting an upper bound, such as 10mb:

LimitXMLRequestBody 10485760

Limiting Concurrency

Apache has several configuration settings that can be used to adjust handling of concurrent requests. The MaxClients is the maximum number of child processes that will be created to serve requests. This may be set too high if your server doesn't have enough memory to handle a large number of concurrent requests.

Other directives such as MaxSpareServers, MaxRequestsPerChild, and on Apache2 ThreadsPerChild, ServerLimit, and MaxSpareThreads are important to adjust to match your operating system, and hardware.

Restricting Access by IP

If you have a resource that should only by accessed by a certain network, or IP address you can enforce this in your apache configuration. For instance if you want to restrict access to your intranet to allow only the 176.16 network:

Order Deny,Allow
Deny from all
Allow from 176.16.0.0/16
 

Or by IP:

Order Deny,Allow
Deny from all
Allow from 127.0.0.1

Adjusting KeepAlive settings

According to the Apache documentation using HTTP Keep Alive's can improve client performance by as much as 50%, so be careful before changing these settings, you will be trading performance for a slight denial of service mitigation.

KeepAlive's are turned on by default and you should leave them on, but you may consider changing the MaxKeepAliveRequests which defaults to 100, and the KeepAliveTimeout which defaults to 15. Analyze your log files to determine the appropriate values.

Run Apache in a Chroot environment

chroot allows you to run a program in its own isolated jail. This prevents a break in on one service from being able to effect anything else on the server.

It can be fairly tricky to set this up using chroot due to library dependencies. I mentioned above that the mod_security module has built in chroot support. It makes the process as simple as adding a mod_security directive to your configuration:

SecChrootDir /chroot/apache

There are however some caveats however, so check out the docs for more info.

Acknowledgments

I have found the book Apache Security to be a highly valuable resource for securing an apache web server. Some of the suggestions listed above were inspired by this book.

Suggestions

Please post any suggestions, caveats, or corrections in the comments and I will update the post if necessary.