Start here
- Install Apache from your distribution and check it runs.
- Learn how the configuration fits together, then add your sites as virtual hosts.
- Turn on HTTPS with a free certificate and HTTP/2.
- Work through the hardening checklist and keep up with security releases.
Most read
- Stop image hotlinkingKeep your images from adorning other sites: Referer rules for Apache 2.4 that still let search engines and your own pages through.
- .htaccess filesWhat they can do, what they cost, and when to put the rules in the main configuration instead.
- mod_rewriteRewrite rules and conditions explained, with the flags you need and how to debug them.
- Fix 403, 500 and 503 errorsRead the error log, find the cause and fix the common Apache errors.
Latest feature
- SSL checkerApache mod_ssl is a web server module that helps in providing secure communication via TLS protocols. Verify TLS/SSL certificate installation errors.
- International Bank Account NumberCheck an IBAN (International Bank Account Number) and look up the bank and its BIC/SWIFT code before you send an international payment.
Apache Guide
- Install ApacheInstall Apache HTTP Server 2.4 on Debian, Ubuntu, RHEL, Fedora, openSUSE, Alpine, macOS and Windows, or build it from source, then start it and check the version.
- Configuration basicsHow Apache httpd 2.4 configuration works: main file and includes, Debian's sites-available layout, key directives, sections, merge order and apachectl -t/-S/-M.
- Virtual hostsSet up name-based virtual hosts in Apache httpd 2.4 on Debian, Ubuntu, RHEL and Fedora: ServerName, ServerAlias, the default vhost, per-site logs and apachectl -S.
- .htaccess filesWhat .htaccess files are, how AllowOverride switches them on, what they cost in speed, when to use the main config instead, and tested 2.4 examples for common jobs.
- mod_rewriteHow Apache httpd 2.4 mod_rewrite works: RewriteRule and RewriteCond, the L, END, R=301, NC and QSA flags, .htaccess vs server config, trace logging, alternatives.
- RedirectsSet up redirects in Apache httpd 2.4: Redirect and RedirectMatch, HTTP to HTTPS, www or non-www, 301 vs 302, 307 and 308, and keeping old URLs alive after a site move.
- Hotlink protectionStop other sites embedding your images with Apache httpd 2.4: mod_rewrite, If/Require and SetEnvIf rules, safe Referer patterns, curl tests, nginx and CDN options.
- AuthenticationPassword-protect a folder or URL in Apache httpd 2.4: htpasswd with bcrypt, Basic auth over HTTPS, user groups, why not Digest, and LDAP or Active Directory logins.
- Access controlAllow or block visitors by IP address, host name or request details in Apache httpd 2.4 with Require, RequireAll and RequireAny, and convert old Order/Allow/Deny rules.
- LoggingWhere Apache httpd 2.4 keeps its logs, the combined format explained field by field, LogFormat, error log levels, rotation with logrotate or rotatelogs, and IP masking.
- Log analysisRead Apache access logs with awk, sort and uniq, build reports with GoAccess, judge AWStats today, and find 404s, 5xx errors, attackers and bad bots in your logs.
- HTTPS and TLSSet up HTTPS on Apache httpd 2.4 with certbot or mod_md, current TLS settings and HSTS, and what the 2025–2028 Let’s Encrypt changes (no OCSP, shorter certificates) mean.
- HTTP/2 and HTTP/3Turn on HTTP/2 in Apache httpd 2.4 with mod_http2 and the event MPM, test it with curl, tune it, and get HTTP/3 today through a front proxy, since 2.4.x has none.
- PHP with ApacheRun PHP on Apache httpd 2.4 with PHP-FPM and mod_proxy_fcgi on Debian, Ubuntu, RHEL and Fedora, why mod_php is legacy, per-site pools, and PHP versions supported in 2026.
- Reverse proxyUse Apache httpd 2.4 mod_proxy in front of Node.js, Python or Java apps: ProxyPass and ProxyPassReverse, WebSockets with upgrade=websocket, X-Forwarded headers, timeouts.
- Load balancingSpread traffic over several backends with Apache httpd 2.4 mod_proxy_balancer: lbmethods, sticky sessions, failover, health checks and a safe balancer-manager.
- Caching and compressionMake Apache httpd 2.4 send fewer bytes: gzip and Brotli compression in the right order, Cache-Control with mod_expires, ETags and 304s, mod_cache_disk, curl tests.
- Performance tuningTune Apache httpd 2.4: pick event, worker or prefork, size MaxRequestWorkers from measured RAM (worked examples), then KeepAlive, Timeout, modules and benchmarks.
- Server statusTurn on mod_status and mod_info in Apache httpd 2.4 without exposing them, read the scoreboard and ?auto output, and feed it to Prometheus, Netdata or Zabbix.
- Troubleshooting errorsFind and fix common Apache httpd 2.4 errors from the real error_log messages: AH00558, Address already in use, 403 Forbidden, 404, 500, proxy 502/503/504 and SELinux.
- Upgrade 2.2 to 2.4Move an Apache 2.2 (or 1.3/2.0) config to httpd 2.4: Order/Allow/Deny to Require, removed and renamed directives, new defaults, MPM and mod_ssl changes, testing.
- Apache vs nginxHow Apache httpd and nginx differ in process model, .htaccess, dynamic content, HTTP/2 and HTTP/3, and how to run nginx in front of Apache. Caddy and LiteSpeed in brief.
- Directory listingsControl Apache httpd 2.4 directory listings with mod_autoindex: disable them with Options -Indexes, or style a download folder with IndexOptions and HeaderName.
- Apache in DockerUse the Docker Official Image httpd (2.4.69 as of November 2026): tags, custom httpd.conf, logs to stdout, graceful reloads, health checks, non-root and Kubernetes.
- CGI and SSIRun CGI scripts with mod_cgi or mod_cgid and ScriptAlias, use Server Side Includes with mod_include, fix common errors, lock both down, and pick modern alternatives.
Security
- Vulnerabilities (CVEs)Key Apache httpd 2.4 CVEs from 2021 to 2026 with the httpd team's severity and fixed-in version, the latest release (2.4.69), and how to check distro backports.
- Hardening checklistHarden Apache httpd 2.4 step by step: ServerTokens, TraceEnable, minimal modules, deny by default, security headers, request limits, permissions and SELinux.
- ModSecurity WAFRun ModSecurity with OWASP CRS 4 on Apache 2.4: project status after Trustwave, v2 vs v3, install on Debian and RHEL, DetectionOnly, paranoia levels, false positives.
- DDoS and bad botsProtect Apache 2.4 from slow clients and floods with mod_reqtimeout, mod_evasive, mod_qos and fail2ban, plus front-end rate limits and rules for bad bots and AI crawlers.
- Hacked site recoveryWhat to do when a site on Apache httpd is hacked: take it offline, preserve logs, find web shells and .htaccess injections, restore, patch and rotate passwords.
News and releases
- Release historyDates of every major Apache httpd release from 0.6.2 (April 1995) to 2.4, end-of-life dates for 1.3, 2.0 and 2.2, and all 2.4.x releases from 2023 to 2026.
- Market shareApache's share in the Netcraft Web Server Survey (September 2026) and W3Techs (November 2026), why the two surveys differ, and how Apache lost first place.
- The ASFWhat the Apache Software Foundation is, how it grew out of the httpd project in 1999, how PMCs, the board, the Incubator and the Apache Way work, and how to contribute.
The Apache ecosystem
The Apache Software Foundation looks after hundreds of open-source projects besides the web server. These pages cover the ones you are most likely to run.
- TomcatApache Tomcat explained: the 11.0, 10.1 and 9.0 branches (November 2026), Tomcat 9 end of support, installing it, and putting it behind Apache httpd safely.
- KafkaApache Kafka explained: topics, brokers and KRaft controllers, the supported 4.4, 4.3 and 4.2 releases (November 2026), a quickstart, and the path off ZooKeeper.
- SparkApache Spark explained: driver, executors and cluster managers, the 4.3.0 release and maintained lines (November 2026), a local install, and security defaults.
- CassandraApache Cassandra explained: the token ring, replication and tunable consistency, the maintained 5.0, 4.1 and 4.0 lines (November 2026), install and security.
- Lucene and SolrApache Lucene and Solr explained: how they fit together, current versions (Lucene 10.6.0, Solr 10.1.0, November 2026), how to try Solr, and how to secure and upgrade it.
- AirflowWhat Apache Airflow does, how its scheduler, Dag processor, API server and workers fit together, current release 3.3.2 (November 2026), install steps and upgrade rules.
- Log4jLog4Shell (CVE-2021-44228) and its follow-up CVEs with fixed versions, current Log4j 2.26.1 (November 2026), Log4j 1.x end of life, and commands to find vulnerable jars.
- Apache License 2.0What the Apache License 2.0 allows, what it requires (license copy, change notices, NOTICE file), how the patent grant works, and why it fits GPLv3 but not GPLv2.
Independent. Apache Today is an independent site. It is not run by or affiliated with the Apache Software Foundation, and "Apache" and the project names are trademarks of the ASF. Software downloads and the official documentation are at httpd.apache.org and apache.org. The news archive lists what the original Apache Today published from 2000 to 2002.