Servers are generally configured in a secure manner when they are first installed

It is impossible to securely configure a web server

Out of the box settings normally meet what is called minimum baseline security standards

The default settings on web servers are not generally secure