diff --git a/modules/caddyhttp/app.go b/modules/caddyhttp/app.go
index 79fd5f414..a63c9bdc8 100644
--- a/modules/caddyhttp/app.go
+++ b/modules/caddyhttp/app.go
@@ -257,6 +257,12 @@ func (app *App) Provision(ctx caddy.Context) error {
 			}
 		}
 
+		// limit max header bytes to a more reasonable default than 1MB from Go std lib
+		// (see https://github.com/php/frankenphp/issues/2459#issuecomment-4655612909)
+		if srv.MaxHeaderBytes <= 0 {
+			srv.MaxHeaderBytes = 16 * 1024
+		}
+
 		// if not explicitly configured by the user, disallow TLS
 		// client auth bypass (domain fronting) which could
 		// otherwise be exploited by sending an unprotected SNI
diff --git a/modules/caddyhttp/server.go b/modules/caddyhttp/server.go
index 0479af83d..0376bca54 100644
--- a/modules/caddyhttp/server.go
+++ b/modules/caddyhttp/server.go
@@ -101,7 +101,7 @@ type Server struct {
 	KeepAliveCount int `json:"keepalive_count,omitempty"`
 
 	// MaxHeaderBytes is the maximum size to parse from a client's
-	// HTTP request headers.
+	// HTTP request headers. Default: 16 KiB.
 	MaxHeaderBytes int `json:"max_header_bytes,omitempty"`
 
 	// Enable full-duplex communication for HTTP/1 requests.