1. Change default Admin password from Web GUI.
2. There is a default guest access on Zabbix, I prefer to disable it from Web GUI.
Administration > User Groups > No access to the frontend > Add guest account here.
3. Hide Apache Server Signature and PHP version
nano /etc/apache2/conf-available/security.conf
ServerTokens Prod
ServerSignature Off
nano /etc/php/7.2/apache2/php.ini
expose_php=Off