Web servers ship with default configurations designed for ease of setup and broad compatibility, not security. These out-of-box settings typically enable unnecessary services, use default credentials, and expose verbose error messages, creating vulnerabilities that administrators must explicitly address.