What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Secure Apache Tomcat by reviewing the exact version you run, reducing its network and file-system exposure, removing unused applications, tightly controlling management interfaces, and treating every deployed application and proxy boundary as untrusted until verified. Tomcat describes its defaults as reasonably secure for most uses, but its security guidance is a configuration reference—not a guarantee that Tomcat, the operating system, network, database, and applications are secure.
This guide uses the Tomcat 11.0.26 documentation (September 9, 2026) and the Tomcat 10.1.60 guidance where behavior differs. Check the security page and packaged configuration that match your installed release before changing production systems.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Apache Tomcat 7 | $40.00 | Buy on Amazon |
| 2 |
|
Apache: The Definitive Guide (3rd Edition) | $28.29 | Buy on Amazon |
| 3 |
|
Professional Apache Tomcat | $9.18 | Buy on Amazon |
| 4 |
|
Apache Tomcat 7 Essentials | $39.99 | Buy on Amazon |
| 5 |
|
Tomcat: The Definitive Guide | $24.00 | Buy on Amazon |
Start with the deployment boundary
Write down the exact Tomcat major and minor version, Java runtime, operating-system account, listening addresses and ports, reverse proxy, deployed applications, cluster members, and management endpoints. The same setting can have different support or risk in different releases. Treat the review as a boundary exercise:
- Which interfaces are public, internal-only, or restricted to a management network?
- Which application code, proxy, AJP peer, cluster member, and administrator account is trusted?
- Which feature is operationally required, and what attack surface does retaining it create?
Tomcat’s security page is not a substitute for the detailed documentation for connectors, valves, realms, deployment, or the applications themselves.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
Run Tomcat with minimum operating-system privilege
Use a dedicated non-root account
Run the service as a dedicated account that is not root (or an equivalent highly privileged identity). Grant only the permissions needed to read the installation and application files, bind the required ports, write logs and temporary data, and access deliberately configured resources. Do not reuse an account that can administer unrelated services.
Protect Tomcat’s trust-boundary directories
Restrict the Tomcat account and approved administrators to configuration, binaries, logs, temporary and work directories, persisted session data, and deployed application content. Review backups and log collectors too. With antiResourceLocking, Tomcat may copy an unpacked application beneath java.io.tmpdir (normally $CATALINA_BASE/temp); temporary uploads can use the same location. An attacker who can alter those files may influence what the server executes or serves.
- Set ownership and permissions after installation and after every deployment.
- Keep secrets out of world-readable configuration, archives, and diagnostic bundles.
- Make sure temporary files cannot be modified by unrelated users or services.
Reduce exposed connectors and listeners
Inventory before editing
Inspect the actual server.xml shipped with your package. Remove connectors that no application or proxy needs. Bind each remaining connector to the required interface with its address attribute; without an explicit address, a connector listens on all configured IP addresses.
Do not expose the example HTTP connector blindly
Tomcat 11’s example configuration includes a non-TLS HTTP/1.1 connector on port 8080. That is an example, not an instruction to publish plaintext HTTP to the internet. Put public traffic behind a correctly configured TLS terminator or configure TLS on the connector, then redirect or reject plaintext traffic according to your deployment policy. Verify the packaged defaults for your release.
Rank #2
Handle AJP as clear text
AJP traffic is clear text and normally belongs only on a trusted network. Limit its listening address and firewall path to the required proxy or peer. The AJP secret value does not make a captured connection confidential; someone able to observe the traffic can observe the secret. If AJP is unnecessary, remove the connector instead.
Check URI parsing and request methods
TRACE is disabled by default; keep it disabled unless you have a documented reason to enable it. Avoid non-default URI parsing behavior behind a reverse proxy until you have assessed the entire routing and authorization chain. Differences in normalization between the proxy and Tomcat can let a request bypass a proxy rule.
Disable the shutdown port or protect it
Tomcat’s Server element has a shutdown port. In Tomcat 11, setting the port attribute to -1 disables that port. If you retain it for operations, use a strong shutdown password and restrict network access so only the local administration path can reach it. Confirm the exact syntax and behavior in your release’s documentation.
Remove unused web applications
Delete examples and samples
Remove bundled applications that are not required. The Examples application should always be removed from security-sensitive Tomcat 10.1 installations; the same principle applies to every release. Sample applications increase the number of URLs, code paths, and potential information disclosures exposed by the server.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Used Book in Good Condition
Keep only required administrative applications
Do not install Manager or Host Manager merely because they are included in a distribution. If operations require them:
- Use unique, long credentials stored through your approved secret-management process.
- Retain
LockOutRealmso repeated failed logins trigger account lockout behavior. - Restrict access to localhost or explicit trusted source ranges with
RemoteCIDRValveand equivalent network controls. - Apply the same restrictions at the firewall or reverse proxy; do not rely on a single layer.
Administrative applications should never be reachable from arbitrary public addresses.
Control deployment and application trust
Assume deployed applications are trusted code
Tomcat does not turn an untrusted application into a safe tenant. Do not place untrusted application packages in a shared instance without an isolation design covering the operating system, data stores, credentials, and network. Application authorization, input validation, session protection, and output encoding remain application responsibilities.
Restrict content-changing features
Limit WebDAV, HTTP PUT, and any other deployment-modifying capability to trusted users and narrow scopes. Review which roles can upload, replace, or delete files. Disable these features when the application does not need them.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #4
Review automatic deployment
In hosted environments, assess autoDeploy and deployOnStartup. Automatic deployment reduces operational work but can make a malicious package easier to activate. For packages you do not fully trust, the Tomcat guidance describes deployXML=false as a way to ignore packaged context.xml files that might request increased privileges. Test this change against applications that legitimately depend on context descriptors.
Reduce information disclosure and protect logs
Return controlled errors
Configure custom error handling or the appropriate ErrorReportValve options so clients do not receive server-version details, stack traces, or JSP source. Test errors in a production-like environment, including malformed requests and failures during startup.
Classify logs as sensitive operational data
Default access logging may include personally identifiable information such as client IP addresses. Modified or debug logging can capture security-sensitive values. Define who may read logs, how long they are retained, where they are copied, and how access is audited. Check that archives and diagnostic exports inherit the same controls as live files.
Reconcile reverse-proxy and cluster controls
Trust proxy headers only from trusted proxies
Connector input is untrusted. If RemoteIpValve, SSLValve, filters, or equivalent components consume forwarded address, scheme, or TLS headers, ensure only known proxies can send them. Align proxy URI normalization with Tomcat’s parsing rules; a mismatch can undermine proxy-enforced authorization or path restrictions.
Best Value
Protect cluster traffic
Use a trusted network for cluster membership and replication. EncryptInterceptor can protect confidentiality and integrity of cluster messages, but it cannot provide availability. Multicast membership still requires a trusted network and should not be exposed beyond the intended cluster.
Tomcat 11 versus Tomcat 10.1: the Security Manager decision
Do not add a Java Security Manager procedure to a Tomcat 11 hardening plan: support was removed in Tomcat 11 and the 11.0.26 guidance identifies it as unsupported. Tomcat 10.1.60 still documents the mechanism, but warns that its restrictions are likely to break most applications and require extensive testing. Version-specific isolation, operating-system permissions, container boundaries, and least-privilege service accounts are safer review directions than copying a 10.1 recipe into an 11.x deployment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical hardening review sequence
- Record the boundary. Capture release, Java, OS identity, connectors, proxy, applications, management interfaces, and cluster membership.
- Back up and stage changes. Preserve known-good configuration and test in a non-production environment.
- Reduce privileges. Move to a dedicated non-root account and lock down configuration, content, logs, work, temp, and session paths.
- Reduce exposure. Remove unused connectors, bind addresses deliberately, keep AJP internal, disable the shutdown port when practical, and retain TLS for public traffic.
- Remove applications. Delete Examples and every bundled application that is not required; gate Manager and Host Manager by source address and strong authentication.
- Constrain deployment. Review WebDAV, PUT, autoDeploy, deployOnStartup, and deployXML according to the trust model.
- Limit disclosure. Test error responses, stack traces, version banners, JSP handling, and log access.
- Validate proxy and cluster assumptions. Test forwarded headers, URI normalization, replication paths, and failure behavior from both trusted and untrusted networks.
- Re-test after upgrades. Compare the new release’s security guidance and packaged XML files; defaults and supported features change.
Troubleshooting common hardening failures
| Symptom | Likely cause | Fix |
|---|---|---|
| Tomcat will not start after changing a connector | Invalid XML, duplicate port, unavailable bind address, or a permission problem | Validate the edited file, inspect startup logs, confirm the address exists, and test the service account’s read and bind permissions. |
| Reverse proxy returns 400 or routes the wrong path | Proxy and Tomcat URI normalization or forwarded-header trust does not match | Compare parsing rules, restrict trusted proxy sources, and test encoded paths and duplicate separators through the complete chain. |
| Manager is inaccessible after adding a restriction | The request source is not in the allowed CIDR, or another proxy rewrites the source address | Verify the address seen by Tomcat, configure the proxy trust chain correctly, and allow only the documented administration ranges. |
| Application fails after enabling deployXML=false | The application depended on a packaged context descriptor | Move required settings into controlled server configuration, or keep the application in a separately isolated instance after reviewing its trust level. |
| Uploads or sessions disappear | Temporary, work, or persisted-session paths were moved or permissions changed | Confirm the configured paths, ownership, free space, cleanup policy, and backup controls without making them writable by unrelated users. |
| Users see stack traces or version details | Default error handling remains enabled | Configure controlled error pages and ErrorReportValve settings, then test representative 4xx, 5xx, and startup-failure responses. |
Or skip the browser setup
If you need a clean, repeatable screenshot of a Tomcat status or documentation page for a change record, ScreenshotNeo returns an image or PDF from one request. It accepts cookie and consent banners before capture and removes more than 60 known consent platforms, newsletter popups, and chat widgets; each step can be disabled. Bot checks, CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and response headers identify the page verdict and billing result. Its MCP server provides take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients.
For a quick capture (see the ScreenshotNeo API documentation):
curl -G 'https://api.screenshotneo.com/v1/shot' -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com -o shot.webpimport requests
r = requests.get('https://api.screenshotneo.com/v1/shot', params={'access_key': 'YOUR_API_KEY', 'url': 'https://example.com'}, timeout=90)
open('shot.webp', 'wb').write(r.content)const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://example.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);The service supports full-page and element captures, 12 device presets or custom viewports, retina scale, dark mode, custom CSS and JavaScript, clicks, waits, request blocking, headers, cookies, user agents, authorization, timezone and geolocation, transparent backgrounds, resizing, TTL caching, signed links, asynchronous webhooks, PDF options, HTML/CSS rendering, bulk capture of up to 100 URLs per call, usage reporting, and an OpenAPI specification. Parameter names used by other screenshot APIs also work. The Free plan includes 1,000 shots per month with no card; paid plans start at $5 for 3,000 shots, and every feature is on every plan. Create a free ScreenshotNeo account.
Frequently Asked Questions
Is Apache Tomcat secure by default?
Tomcat characterizes its defaults as reasonably secure for most use cases, but that is not a deployment guarantee. Exposed connectors, installed applications, operating-system permissions, proxy behavior, databases, and application code still require an explicit review.
Should I disable every Tomcat connector?
No. Remove connectors you do not need and bind required connectors to deliberate interfaces. Public traffic needs an appropriate TLS design; AJP should remain only on a trusted network when it is required.
Can I use Java Security Manager with Tomcat 11?
No. Tomcat 11 does not support it. Tomcat 10.1 documents it with warnings about application breakage and extensive testing, so do not transfer a 10.1 procedure to an 11.x installation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
