VMware ESXi and vSphere Cluster Management

What Is Apache HTTP Server?

Learn what Apache HTTP Server is, how it handles web requests, and how virtual hosts, modules, HTTPS, reverse proxying, and configuration work.

Apache HTTP Server at a Glance

Apache HTTP Server, commonly shortened to Apache, is open-source web server software. It accepts HTTP and HTTPS requests from clients such as web browsers and responds with website files or results from an application.

Apache HTTP Server is a software project associated with the Apache Software Foundation. The foundation is a nonprofit organization that supports and stewards Apache projects; it is not the web server itself.

Primary purpose: Serve web content and respond to HTTP/HTTPS requests.

License: Apache License.

Architecture: Extensible through modules.

Common deployments: Linux and Unix-like servers, as well as Windows and other supported platforms.

Typical roles: Static web server, virtual-host platform, TLS endpoint, reverse proxy, and load balancer.

How a Web Server Works

A web server is software that receives web requests and sends responses. The term can also refer to the machine running that software. Apache is the software layer that listens for requests, applies configuration rules, reads files or contacts backend services, and returns responses.

HTTP is the application protocol used for many browser-to-server requests. HTTPS is HTTP protected by TLS encryption. A TLS certificate is a digital credential that helps identify the server and establish an encrypted connection.

  1. A visitor enters https://example.com in a browser.
  2. The browser resolves the domain and connects to the server, usually over an HTTPS port.
  3. The browser sends an HTTP request containing information such as the requested path and hostname.
  4. Apache selects the matching site configuration, often called a virtual host.
  5. Apache either reads a static file, such as an HTML, CSS, JavaScript, or image file, or forwards the request to an application backend.
  6. Apache sends an HTTP response. The browser receives it and renders the page.

Browser: Requests and displays web resources. Example: A visitor opening a site.

Apache: Receives requests and serves or forwards responses. Example: A public web entry point.

Application backend: Produces dynamic content. Example: A web application process.

Database: Stores application data. Example: Product or account records.

Static content already exists as a file, so Apache can return it directly. Dynamic content is generated when a request arrives, usually by an application that uses input, business rules, or database data. Apache may serve static assets while acting as a front end for the application that generates dynamic responses.

Apache Background and Project History

The Apache HTTP Server project began as an open-source project in the mid-1990s. It grew from work related to the earlier NCSA HTTPd web server software, with contributors improving, maintaining, and extending the code.

Apache became a longstanding web platform because it combined open development, broad operating-system support, configurable behavior, and a modular design. Its ability to host many kinds of sites and integrate with different application environments also helped it remain useful across changing hosting practices. Historical adoption figures should not be treated as current measurements unless they are tied to a named source and publication date.

Open-Source Licensing

Apache HTTP Server is free and open-source software. Its source code is available under the Apache License, a permissive open-source license. Subject to the license terms, organizations and individuals can use, inspect, modify, and redistribute the software, including as part of larger solutions.

Free software does not mean that operating a server is effortless or cost-free in every practical sense. A production deployment still requires configuration, monitoring, backups, security updates, troubleshooting, and administrators with suitable operational skills.

Supported Operating Systems

Apache is cross-platform. It is especially common on Linux and other Unix-like systems, and versions are also available for Windows and additional supported platforms.

Installation and administration details differ by operating system and distribution. Package names, service names, executable names, configuration directories, included files, log locations, and service-management commands may all vary. For example, Debian- and Ubuntu-style systems commonly use apache2, while RHEL- and Fedora-style systems commonly use httpd.

Core Features

Serving Sites and Multiple Domains

With sufficient CPU, memory, network capacity, and suitable configuration, Apache can serve substantial traffic. One Apache installation can host multiple websites through virtual hosts, with each site having its own hostname, files, rules, and logs.

Custom Errors and Access Control

Apache can return customized error documents, such as a helpful branded page for a missing resource. It also supports authentication, which verifies a user or client identity before allowing access. Options include password-based access controls and certificate-based client authentication.

Reverse Proxying and Load Balancing

As a reverse proxy, Apache accepts public client requests and forwards them to backend services. A backend might be an application process listening on a private port. Apache can also provide load balancing by distributing requests among multiple backend servers or application instances.

Administration Interfaces

Some hosting environments provide graphical or web-based administration interfaces. However, text configuration files and command-line tools remain standard methods for administering Apache, especially on servers managed by system administrators.

Virtual hosts: Hosts multiple domains on one server. Example: Separate company and blog sites.

TLS support: Encrypts browser connections. Example: An HTTPS website.

Authentication: Restricts access. Example: An internal documentation area.

Custom errors: Defines error responses. Example: A branded 404 page.

Reverse proxying: Forwards requests to applications. Example: A front end for an application server.

Load balancing: Shares requests among backends. Example: Multiple application instances.

Apache's Modular Architecture

Apache extends its functionality through modules. A module is an add-on component that supplies a capability or changes how Apache handles part of a request.

  • TLS modules support encrypted HTTPS connections.
  • URL-rewriting modules transform or route requested URLs.
  • Proxy modules forward requests to backend services.
  • Authentication modules support different identity and access mechanisms.
  • Compression modules reduce response sizes in suitable situations.
  • Scripting-integration modules connect Apache with application runtimes.

At a conceptual level, functionality may be compiled into Apache, loaded statically as part of the server, or loaded dynamically when enabled. The exact mechanism depends on the build and operating-system packaging.

Enabling unnecessary modules increases configuration complexity and may increase the attack surface. Enable only the capabilities the deployment needs, and keep enabled modules updated.

Virtual Hosts

A virtual host is a configuration that lets one Apache instance serve a particular hostname or website. Name-based virtual hosting uses the hostname in the request, such as example.com or blog.example.com, to select the appropriate site configuration.

  • ServerName identifies the primary hostname for a virtual host.
  • ServerAlias lists additional hostnames that should use the same configuration.
  • DocumentRoot identifies the directory from which Apache serves that site's files.
  • ErrorLog identifies a location for site-specific diagnostic messages.
  • CustomLog identifies a location for records of requests handled by the site.

For example, example.com and blog.example.com can share one Apache installation while using different document roots and log files. Apache examines the requested hostname and routes each request to the matching virtual host.

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/example.com

    ErrorLog ${APACHE_LOG_DIR}/example.com-error.log
    CustomLog ${APACHE_LOG_DIR}/example.com-access.log combined
</VirtualHost>

This is a minimal HTTP illustration, not a complete production configuration. An HTTPS site normally needs a TLS virtual host, a suitable certificate, a private key, and related TLS settings. The certificate must cover the requested hostname.

Configuration Basics

Apache configuration files define how the server listens, which modules are enabled, how requests are routed, where files are served, which users may access resources, and where logs are written.

A directive is a named configuration instruction with a value, such as DocumentRoot. A section groups settings that apply to a host, directory, location, or other scope. An include loads settings from another configuration file. Many operating systems provide separate site-specific files that are included by the main configuration.

A safe configuration workflow is:

  1. Edit the relevant configuration file.
  2. Run a syntax test.
  3. Correct any reported errors.
  4. Reload Apache, or restart it when a reload is not sufficient.
  5. Inspect access and error logs and test the affected site.

Do not reload blindly after an edit. A syntax error or missing included file can prevent Apache from applying the change, and in some situations can stop the service from starting normally.

Syntax Tests and Reloads

On Debian- or Ubuntu-style systems, a syntax check commonly uses:

sudo apache2ctl configtest

On RHEL- or Fedora-style systems, the equivalent commonly uses:

sudo httpd -t

After a successful test, a systemd-managed service can commonly be reloaded with:

sudo systemctl reload apache2
sudo systemctl reload httpd

Use the command matching the platform. A reload applies configuration changes without the full interruption normally associated with a restart, when supported.

Custom Error Documents

A site can map a 404 response to a custom page:

ErrorDocument 404 /errors/not-found.html

The referenced page must be available through the appropriate document root or URL mapping.

Security and Operations

  • Apply Apache, operating-system, module, and application security updates.
  • Disable modules and features that the deployment does not need.
  • Protect private files, configuration secrets, credential files, and application source code from web access.
  • Use HTTPS for public traffic and configure certificates correctly.
  • Use file ownership and permissions based on least privilege: processes should have only the access they require.
  • Monitor access logs for request activity and error logs for warnings, failures, and diagnostic information.

Production tuning depends on the workload, available memory and CPU, operating system, enabled modules, network conditions, and application design. There is no single set of performance values that is correct for every Apache deployment.

When Apache Is Used

  • Serving static websites and assets.
  • Hosting multiple websites on one server with virtual hosts.
  • Acting as a TLS endpoint for HTTPS connections.
  • Reverse proxying requests to application services.
  • Distributing traffic among backend instances through load balancing.
  • Providing controlled access to private or protected content.

Apache is one option among several web servers and reverse proxies. The best choice depends on the required features, existing tools, performance needs, operating environment, and the team's operational experience. It is not universally the best choice for every workload.

Troubleshooting Common Problems

Apache Fails to Reload

Likely causes include a syntax error, a misspelled directive, a missing required module, or an invalid or unreadable included file. Run the appropriate configuration test, read the reported file and line number, review recent edits, and check the error log for additional detail.

The Wrong Website Appears for a Domain

Check DNS first. Then verify ServerName and ServerAlias, confirm that the intended virtual host is enabled, and check whether a default virtual host is handling unmatched requests. Where appropriate, test with an explicit HTTP Host header.

A 403 Forbidden Response Appears

Review the error log. Check whether Apache can read the files and traverse every parent directory, then inspect directory access rules and Require directives. A missing permitted index file or operating-system security policy can also cause a 403 response.

HTTPS Does Not Work

Confirm that the certificate matches the requested hostname, its validity period is current, and its certificate chain is complete. Check the TLS virtual host, certificate paths, Apache's listening ports, firewall rules, and network access to port 443.

A Proxied Application Returns 502 or 503

Check Apache and backend application logs. Verify that the backend is running and listening on the configured address and port, test connectivity from the Apache host, and review proxy targets. Investigate timeouts and capacity only after basic connectivity is confirmed.

Key Terms to Remember

  • Apache HTTP Server: Open-source server software that delivers web content and handles HTTP and HTTPS requests.
  • Apache Software Foundation: The nonprofit organization associated with stewardship of Apache projects.
  • Module: An add-on component that extends Apache capabilities.
  • Virtual host: A configuration that lets one Apache instance serve a particular hostname or website.
  • DocumentRoot: The directory from which Apache serves a site's files.
  • Reverse proxy: A server role in which Apache accepts client requests and forwards them to backend services.
  • Authentication: Verifying a user or client identity before allowing access.
  • Access log: A record of requests handled by the server.
  • Error log: A record of server warnings, failures, and diagnostic messages.

For related foundational reading, see What Is Apache HTTP Server?.