Apache's module architecture is one of its strongest features. Each module is also an additional attack surface. A walk through which modules are usually loaded by default, what each one does, and which ones you almost certainly do not need.
A walk through the family of attacks that exploit the gap between a URL string and the file the web server actually opens. The bugs are old. The pattern is the same. The defence is the same. The frequency is unbroken.
What I changed on a Slackware box before I was happy to put it on the open internet with a real web server running. None of it is exotic. All of it matters.