Apache HTTP Server course

What Is Apache HTTP Server?

Learn what Apache HTTP Server is, how web servers handle requests, its modules and configuration model, common use cases, and basic operational troubleshooting.

Apache HTTP Server, commonly called Apache, is open-source web server software. It accepts HTTP and HTTPS requests from clients such as web browsers, then returns website content or forwards requests to application services that generate responses.

This article explains what a web server does, how Apache processes requests, its core capabilities, common deployment patterns, and introductory administration and security practices.

Apache HTTP Server at a Glance

What Is a Web Server?

A web server is software that accepts web requests and delivers content or forwards requests to other services. The web uses the HTTP application protocol for request and response communication.

In a basic client-server exchange:

1. A user enters a URL or selects a link in a browser.
2. DNS translates the domain name into an IP address.
3. The browser connects to the server and sends an HTTP request, such as a request for an HTML page.
4. The web server decides how to handle the request.
5. The server returns an HTTP response containing a status code, headers, and possibly content.
6. The browser renders the response and requests related assets such as CSS, JavaScript, images, or fonts.

Apache can serve static files directly. These include HTML documents, CSS stylesheets, JavaScript files, images, videos, and downloads. It can also forward a request to an application runtime or upstream service when the response must be generated dynamically.

HTTP and HTTPS

HTTPS is HTTP protected by TLS encryption. A TLS certificate is a digital certificate that helps authenticate the server for a hostname and enables an encrypted connection. With Apache, TLS negotiation occurs before the encrypted HTTP request is processed.

Apache may serve the files itself, or terminate the public HTTPS connection and pass a request to an internal application over a separately designed connection.

What Apache Is—and Is Not

Apache HTTP Server is web server software. It is not a web browser, which is the client that requests and displays resources. It is not a database, which stores and queries structured data. It is not a programming language, and it is not automatically the application that generates every dynamic page.

Apache can work alongside PHP, Python, Java, Node.js, containers, and other backend services. The exact integration depends on the deployment design. Apache is one option among web servers and reverse proxies, rather than a requirement for every website.

The Apache Software Foundation is the nonprofit organization associated with stewardship of Apache projects. The Apache HTTP Server project is one project within that broader foundation; the two names should not be treated as the same thing.

Apache Background and Open-Source Status

Apache HTTP Server began in the mid-1990s and evolved from work related to NCSA HTTPd. It is free and open-source software, so its source code can be inspected and used under its license terms.

The Apache License 2.0 is a permissive open-source license. In practical terms, it permits use, modification, redistribution, and redistribution of modified versions, subject to conditions such as preserving required notices and complying with the license. Always consult the license text for the obligations relevant to a particular distribution.

Apache has a long history in web hosting, but historical adoption figures should not be assumed to describe current server usage.

Supported Platforms

Apache is cross-platform. It is especially common on Linux and other Unix-like operating systems, where distributions provide packages and service-management integration. Windows and macOS are also supported where applicable.

Available modules, default directories, executable names, service names, and packaging workflows depend on the operating system and its current Apache release documentation. A tutorial written for one distribution should not be assumed to use the same paths on another.

Core Apache Capabilities

Virtual Hosts

A virtual host is an Apache configuration that lets one installation serve separate websites or domains. A virtual host can define a domain, a document root, log files, redirects, TLS settings, and access rules.

A document root is the filesystem directory from which a site's public files are served. For example, two domains might use /var/www/example.com and /var/www/blog.example.com.

With name-based virtual hosting, Apache commonly selects a site using the requested IP address, port, and HTTP Host header. IP-based virtual hosting selects a site based on the destination IP address. Name-based hosting allows many domains to share one IP address.

Authentication and Authorization

Authentication verifies who a user or client is. Authorization determines which resources that authenticated identity may access. Apache can protect an administrative path, restrict access by address or group, and combine authentication with authorization rules.

Proxying and Load Balancing

A reverse proxy is an arrangement in which Apache receives client requests and passes them to backend applications or services. A backend can listen on an internal port without being directly reachable from the public internet.

Load balancing distributes requests across multiple backend servers. This can improve capacity and availability when the backends, health checks, session handling, timeouts, and failure procedures are designed appropriately.

Apache's Modular Architecture

A module is an Apache component that adds or implements a feature. Some functionality is built into the server, some modules are loaded dynamically, and other optional modules are enabled only when needed. Packaging and loading mechanisms vary by platform.

• mod_ssl adds TLS support for HTTPS.
• mod_proxy provides core proxying functionality, with related modules for particular protocols and balancing methods.
• mod_rewrite supports URL rewriting and redirects.
• Authentication modules add mechanisms for verifying identities and applying access controls.

Enabling only the modules required by a deployment reduces configuration complexity and can reduce the attack surface. A module should be enabled because a feature needs it, not simply because it is available.

Apache's Configuration Model

Apache reads a main server configuration and may include additional configuration files. Distribution packages commonly separate global settings, available modules, enabled modules, available sites, and enabled sites, although the names and locations differ.

A directive is a configuration instruction read by Apache, such as a directive that sets a document root or log destination. A container is a group of directives whose scope is limited by a section such as VirtualHost, a directory, or a URL path.

Global settings apply to the server or multiple sites. Per-site virtual-host settings keep a domain's document root, hostnames, logs, redirects, TLS options, and access rules together. Configuration can also be inherited or overridden according to directive and context rules, so a directive's allowed scope matters.

For background on common layouts, see Apache configuration files, the apache2.conf file, and the documentation for available sites and enabled sites.

Illustrative Name-Based Virtual Host

The following is a conceptual example of two-site hosting. It is illustrative, not a universal drop-in configuration.

<VirtualHost *:80>
  ServerName example.com
  DocumentRoot /var/www/example.com
  ErrorLog ${APACHE_LOG_DIR}/example-error.log
  CustomLog ${APACHE_LOG_DIR}/example-access.log combined
</VirtualHost>

<VirtualHost *:80>
  ServerName blog.example.com
  DocumentRoot /var/www/blog.example.com
  ErrorLog ${APACHE_LOG_DIR}/blog-error.log
  CustomLog ${APACHE_LOG_DIR}/blog-access.log combined
</VirtualHost>

Actual file paths, log variables, include locations, permissions, and site-enablement workflows vary by platform. A production site would also normally define appropriate HTTPS behavior.

How Apache Processes a Request

1. DNS resolution: The browser resolves the domain name to an IP address.
2. Connection: The browser connects to the server's address and port. For HTTPS, TLS negotiation and certificate validation occur before the HTTP exchange is protected.
3. HTTP request: The browser sends a method, path, headers, and possibly a request body.
4. Virtual-host selection: Apache uses the connection details and, for name-based hosting, the Host header to select a virtual host.
5. Access checks: Apache evaluates authentication, authorization, filesystem permissions, and other access rules.
6. Content handling: Apache maps the URL to a document root and serves a static file, applies a rewrite or redirect, or passes the request through a module to a backend.
7. Response: Apache sends a status code, headers, and response content back to the client.
8. Logging: Apache records the request in an access log and records failures or diagnostic information in an error log.

This flow connects the major concepts: virtual hosts choose site-specific settings, modules perform specialized work, document roots provide static content, proxy rules reach applications, and logs help operators understand what happened.

Common Apache Use Cases

• Static websites: Serve HTML, CSS, JavaScript, images, and downloads directly from a document root.
• Multiple domains: Host several websites on one machine with separate virtual hosts, roots, logs, and rules.
• HTTPS termination: Accept encrypted public traffic using a TLS certificate and apply site-specific TLS settings.
• Reverse proxying: Put Apache in front of an application server and forward selected paths to an internal port.
• Load balancing: Distribute requests among several backend services.
• Protected content: Require authentication and apply authorization rules to an administrative or private URL path.

Example: A Static Site

A browser requests https://example.com/. Apache selects the virtual host for example.com, checks access rules, finds an index file under that site's document root, and returns the HTML. The browser then requests the page's CSS, JavaScript, and images, which Apache serves as additional static responses.

Example: Apache in Front of an Application

Apache can terminate HTTPS at the public edge and forward a request such as /app/ to an application listening on an internal port. The backend can remain inaccessible from the public network while Apache handles the public hostname, certificates, logs, and access controls.

ProxyPass /app/ http://127.0.0.1:3000/
ProxyPassReverse /app/ http://127.0.0.1:3000/

This reverse-proxy illustration requires the relevant proxy modules. Production deployments also require deliberate TLS, forwarding-header, timeout, routing, and access-control decisions.

Example: Protecting an Administrative Area

A site can require authentication before allowing access to /admin/. After a user is identified, authorization rules determine whether that user or group is allowed to use the resource. Authentication answers “Who are you?”; authorization answers “What may you access?”

Operational and Security Basics

• Keep Apache updated using trusted operating-system packages or official release sources.
• Use least privilege: run services with only the permissions they need, and avoid making web-served files broadly writable.
• Manage filesystem ownership and permissions carefully, especially for document roots, uploaded files, and configuration files.
• Use valid TLS certificates and review TLS configuration rather than accepting insecure defaults indefinitely.
• Enable only necessary modules and restrict exposed proxy, administration, and diagnostic features.
• Review access and error logs for failures, unusual requests, authentication events, and possible attacks.
• Test configuration changes before applying them, then use a graceful reload when appropriate so existing connections can finish.

Apache's access and error logs are central to operations. TLS setup is covered in Configure SSL, while platform-specific installation examples are available for Ubuntu and Windows.

Configuration Validation and Service Management

Executable names and service names vary by operating system and package. Validate the configuration before reloading it:

apachectl configtest
httpd -t

Typical service-management examples include:

systemctl status apache2
systemctl reload apache2

systemctl status httpd
systemctl reload httpd

Debian-derived systems commonly use apache2, while Red Hat-derived systems commonly use httpd. These are examples, not universal commands.

Troubleshooting Common Problems

Apache Will Not Start or Reload

• Possible causes: A syntax error, an invalid directive context, a missing module, or a port already in use.
• First checks: Run the configuration test, inspect the error log and service-manager output, and verify enabled modules and listening-port settings.

The Wrong Website Appears

• Possible causes: An incorrect or missing ServerName or ServerAlias, a site that was not included or enabled, DNS pointing elsewhere, or the default virtual host handling the request.
• First checks: Confirm DNS resolution, inspect loaded virtual hosts, verify the request's Host header behavior, and check virtual-host order.

A 403 Forbidden Response Appears

• Possible causes: Filesystem ownership or permissions, directory authorization rules, a missing acceptable directory index, or a mandatory access-control policy.
• First checks: Review the error log, verify directory permissions and Apache access rules, and check platform security controls where used.

A 502 or 503 Appears Through a Reverse Proxy

• Possible causes: The backend is stopped, the upstream host or port is wrong, a firewall blocks the connection, or a timeout or protocol mismatch exists.
• First checks: Test the backend locally, inspect Apache and backend logs, and confirm the proxy target and timeout settings.

HTTPS Shows a Certificate Warning

• Possible causes: The certificate does not match the hostname, its chain is incomplete, it has expired, or the TLS virtual-host configuration is incorrect.
• First checks: Confirm the requested hostname and certificate validity, inspect chain installation, and review TLS virtual-host settings and logs.

Key Takeaways

• Apache HTTP Server is open-source software that handles HTTP and HTTPS requests.
• It can serve static files or forward requests to dynamic application services.
• Virtual hosts allow one installation to serve multiple websites with separate settings.
• Modules provide features such as TLS, proxying, rewriting, authentication, and authorization.
• Configuration uses directives and scoped containers, with global and per-site settings commonly separated.
• Access logs and error logs are essential for diagnosis and auditing.
• Safe administration includes updates, least privilege, careful permissions, configuration testing, graceful reloads, and limited module exposure.

Related Apache Topics

• What is a web server?
• Apache HTTP Server tutorial
• Create a new virtual host
• Configure Apache as a reverse proxy
• Apache access and error logs
• The mods-available directory
• The mods-enabled directory