If you're going to use your webserver in actual production, and you're worried about attacks, you probably shouldn't be using C. Not because of the typical lame excuses people use these days like "it takes an extra 5 seconds compared to higher level languages!" It's because the lack of safety is a huge security risk. Companies using C servers always get hacked, and sometimes the attacker can even do arbitrary code execution. This is because the smallest oversight will cause "undefined behavior". This is usually no big deal in a client program, because it merely causes bugs. But hackers abusing it intentionally can do some serious damage.

It's probably not a bad idea to write some of the server-side programs in C or some other language depending on what you're trying to do. But definitely not for the API or anything interacting with the user.