Apache HTTP Server guide: install, configure, secure, tune
These guides cover the Apache HTTP Server 2.4, the current branch, with httpd 2.4.69 as the latest release as of November 2026. Every example is written for 2.4 and shows the Debian/Ubuntu and RHEL/Fedora variants where they differ. If you are new to Apache, follow the path below in order. If you are fixing a problem, jump straight to the guide you need.
Where to start
- Install. Get httpd from your distribution’s packages, so security fixes arrive with normal system updates: Install Apache.
- Understand the configuration. Learn where the files are, how sections and the merge order work, and the test-then-reload routine (
apachectl configtest, then a graceful reload): Configuration basics. - Add your sites. One
<VirtualHost>per domain, a catch-all default, separate logs: Virtual hosts. - Decide about .htaccess. Use per-folder files only when you cannot edit the main configuration: .htaccess files.
- Secure it. Turn on HTTPS, work through the hardening checklist, and protect private areas with access control and passwords. Keep the server patched; the Security section explains how.
- Tune it. Choose and size the MPM in Performance tuning, then add compression and caching and HTTP/2.
- Keep it running. Read your logs, watch server status, and use Troubleshooting errors when something breaks.
If you already run Apache
- Inheriting an old server? Upgrade 2.2 to 2.4 explains the changes that break 2.2-era configs, such as
RequirereplacingOrder/Allow/Deny. - Putting an application behind Apache? See PHP with PHP-FPM, reverse proxying and load balancing.
- Moving URLs or stopping other sites from using your images? See redirects, mod_rewrite and hotlink protection.
- Comparing servers? Apache vs nginx sets out the differences without invented benchmark numbers.
How these guides are written
Every directive, default and path is checked against the Apache httpd 2.4 documentation and the distributions’ own packages and documentation, which are listed under Sources on each page. Commands that need root use sudo. Old 2.2 syntax appears only where it is labeled as old syntax you may still see. This site is independent and is not affiliated with the Apache Software Foundation. For the reference manual and downloads, go to httpd.apache.org.
All guides
- Install ApacheInstall Apache HTTP Server 2.4 on Debian, Ubuntu, RHEL, Fedora, openSUSE, Alpine, macOS and Windows, or build it from source, then start it and check the version.
- Configuration basicsHow Apache httpd 2.4 configuration works: main file and includes, Debian's sites-available layout, key directives, sections, merge order and apachectl -t/-S/-M.
- Virtual hostsSet up name-based virtual hosts in Apache httpd 2.4 on Debian, Ubuntu, RHEL and Fedora: ServerName, ServerAlias, the default vhost, per-site logs and apachectl -S.
- .htaccess filesWhat .htaccess files are, how AllowOverride switches them on, what they cost in speed, when to use the main config instead, and tested 2.4 examples for common jobs.
- mod_rewriteHow Apache httpd 2.4 mod_rewrite works: RewriteRule and RewriteCond, the L, END, R=301, NC and QSA flags, .htaccess vs server config, trace logging, alternatives.
- RedirectsSet up redirects in Apache httpd 2.4: Redirect and RedirectMatch, HTTP to HTTPS, www or non-www, 301 vs 302, 307 and 308, and keeping old URLs alive after a site move.
- Hotlink protectionStop other sites embedding your images with Apache httpd 2.4: mod_rewrite, If/Require and SetEnvIf rules, safe Referer patterns, curl tests, nginx and CDN options.
- AuthenticationPassword-protect a folder or URL in Apache httpd 2.4: htpasswd with bcrypt, Basic auth over HTTPS, user groups, why not Digest, and LDAP or Active Directory logins.
- Access controlAllow or block visitors by IP address, host name or request details in Apache httpd 2.4 with Require, RequireAll and RequireAny, and convert old Order/Allow/Deny rules.
- LoggingWhere Apache httpd 2.4 keeps its logs, the combined format explained field by field, LogFormat, error log levels, rotation with logrotate or rotatelogs, and IP masking.
- Log analysisRead Apache access logs with awk, sort and uniq, build reports with GoAccess, judge AWStats today, and find 404s, 5xx errors, attackers and bad bots in your logs.
- HTTPS and TLSSet up HTTPS on Apache httpd 2.4 with certbot or mod_md, current TLS settings and HSTS, and what the 2025–2028 Let’s Encrypt changes (no OCSP, shorter certificates) mean.
- HTTP/2 and HTTP/3Turn on HTTP/2 in Apache httpd 2.4 with mod_http2 and the event MPM, test it with curl, tune it, and get HTTP/3 today through a front proxy, since 2.4.x has none.
- PHP with ApacheRun PHP on Apache httpd 2.4 with PHP-FPM and mod_proxy_fcgi on Debian, Ubuntu, RHEL and Fedora, why mod_php is legacy, per-site pools, and PHP versions supported in 2026.
- Reverse proxyUse Apache httpd 2.4 mod_proxy in front of Node.js, Python or Java apps: ProxyPass and ProxyPassReverse, WebSockets with upgrade=websocket, X-Forwarded headers, timeouts.
- Load balancingSpread traffic over several backends with Apache httpd 2.4 mod_proxy_balancer: lbmethods, sticky sessions, failover, health checks and a safe balancer-manager.
- Caching and compressionMake Apache httpd 2.4 send fewer bytes: gzip and Brotli compression in the right order, Cache-Control with mod_expires, ETags and 304s, mod_cache_disk, curl tests.
- Performance tuningTune Apache httpd 2.4: pick event, worker or prefork, size MaxRequestWorkers from measured RAM (worked examples), then KeepAlive, Timeout, modules and benchmarks.
- Server statusTurn on mod_status and mod_info in Apache httpd 2.4 without exposing them, read the scoreboard and ?auto output, and feed it to Prometheus, Netdata or Zabbix.
- Troubleshooting errorsFind and fix common Apache httpd 2.4 errors from the real error_log messages: AH00558, Address already in use, 403 Forbidden, 404, 500, proxy 502/503/504 and SELinux.
- Upgrade 2.2 to 2.4Move an Apache 2.2 (or 1.3/2.0) config to httpd 2.4: Order/Allow/Deny to Require, removed and renamed directives, new defaults, MPM and mod_ssl changes, testing.
- Apache vs nginxHow Apache httpd and nginx differ in process model, .htaccess, dynamic content, HTTP/2 and HTTP/3, and how to run nginx in front of Apache. Caddy and LiteSpeed in brief.
- Directory listingsControl Apache httpd 2.4 directory listings with mod_autoindex: disable them with Options -Indexes, or style a download folder with IndexOptions and HeaderName.
- Apache in DockerUse the Docker Official Image httpd (2.4.69 as of November 2026): tags, custom httpd.conf, logs to stdout, graceful reloads, health checks, non-root and Kubernetes.
- CGI and SSIRun CGI scripts with mod_cgi or mod_cgid and ScriptAlias, use Server Side Includes with mod_include, fix common errors, lock both down, and pick modern alternatives.