how to harden web server

Good way to ask a question so broad it is impossible to answer. Could you narrow it down a little? I know you want it to be "general" but this is far too "general" to be useful.

First of all,read this. That'll help you in the long run.

Then, you say you want a secure web server? Get Apache 3.3.34, which currently has just one vulnerability. Run it on Linux and lock that down tightly - read up on the major threads in the Linux - Security forum and check out the tutorials on AntiOnline. Stop any unwanted services and filter all opened ports with a good firewall. Run an IDS, like Snort. Test your own system with vulnerability scanners and the like before taking the server live.

Now you should have a pretty tough server.

Cheers,

-jk

Ps. Welcome to LQ!!

Put it behind a hardened firewall box, perhaps. Open the minimum of ports. Keep the packages on the web server up to date, ie latest apache all the time and whatever other apps you are running.

And use tripwire/samhain/.. integrity checkers.
Very important

...if you can't place the advice above in perspective, please check out the LQ FAQ: Security references: Checklists, Securing and Hardening.