diff --git a/web/Containerfile b/web/Containerfile
index e8b5998..c84f8a7 100644
--- a/web/Containerfile
+++ b/web/Containerfile
@@ -1,4 +1,17 @@
 FROM docker.io/library/php:apache
 
 RUN docker-php-ext-install mysqli bcmath
-COPY ./www/* /var/www/html
\ No newline at end of file
+
+# Use PHP's production defaults (no error output to clients) and hide the PHP version.
+RUN cp "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini" \
+ && printf 'expose_php = Off\n' > "$PHP_INI_DIR/conf.d/zz-hardening.ini"
+
+# Disable directory listings and reduce the server signature.
+RUN sed -i 's/^\(\s*Options\) Indexes FollowSymLinks/\1 FollowSymLinks/' /etc/apache2/apache2.conf \
+ && sed -i -e 's/^ServerTokens .*/ServerTokens Prod/' -e 's/^ServerSignature .*/ServerSignature Off/' /etc/apache2/conf-available/security.conf
+
+COPY ./www/* /var/www/html
+
+# The web server must not be able to create or modify files in the document root.
+RUN chown -R root:root /var/www/html \
+ && chmod -R u=rwX,go=rX /var/www/html