In addition to these, there's also the CIS benchmarks.

Apache HTTP: https://benchmarks.cisecurity.org/tools2/apache/CIS_Apache_H...

Tomcat: https://benchmarks.cisecurity.org/tools2/apache/CIS_Apache_T...