Apache HTTP Server Cheat Sheet
Essential Apache HTTPD configuration directives for virtual hosts, modules, rewrites, and reverse proxying.
2 PagesIntermediateFeb 12, 2026
Virtual Host
Serve a domain with a dedicated document root.
apache
<VirtualHost *:80> ServerName example.com ServerAlias www.example.com DocumentRoot /var/www/example.com <Directory /var/www/example.com> AllowOverride All Require all granted </Directory> ErrorLog ${APACHE_LOG_DIR}/example-error.log CustomLog ${APACHE_LOG_DIR}/example-access.log combined</VirtualHost>
Reverse Proxy
Proxy requests to a backend app using mod_proxy.
apache
<VirtualHost *:80> ServerName api.example.com ProxyPreserveHost On ProxyPass / http://127.0.0.1:3000/ ProxyPassReverse / http://127.0.0.1:3000/</VirtualHost># Requires: a2enmod proxy proxy_http
URL Rewriting
Redirect and rewrite URLs with mod_rewrite.
apache
<IfModule mod_rewrite.c> RewriteEngine On # Force HTTPS RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] # Route non-file requests to index.php RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^ index.php [L]</IfModule>
CLI & Module Management
Debian/Ubuntu-style module and site management tools.
- a2enmod / a2dismod- Enable/disable an Apache module (e.g. a2enmod ssl)
- a2ensite / a2dissite- Enable/disable a virtual host config in sites-available
- apachectl configtest- Validate configuration syntax before reloading (same as apache2ctl -t)
- systemctl reload apache2- Graceful reload picking up config changes without dropping connections
- mod_ssl- Provides TLS termination via SSLCertificateFile/SSLCertificateKeyFile directives
- mod_headers- Adds/modifies HTTP response headers (e.g. security headers)
MPM Event Tuning
Configure the event MPM for high-concurrency workloads with async keep-alive handling.
apache
<IfModule mpm_event_module> StartServers 3 ServerLimit 16 ThreadsPerChild 25 ThreadLimit 64 MaxRequestWorkers 400 MinSpareThreads 75 MaxSpareThreads 250 MaxConnectionsPerChild 10000</IfModule># Check which MPM is activeapachectl -V | grep -i mpm
Load Balancing with mod_proxy_balancer
Distribute traffic across multiple backend members with health checks.
apache
<Proxy "balancer://mycluster"> BalancerMember http://10.0.0.1:3000 loadfactor=5 BalancerMember http://10.0.0.2:3000 loadfactor=5 BalancerMember http://10.0.0.3:3000 status=+H ProxySet lbmethod=byrequests</Proxy><VirtualHost *:80> ServerName app.example.com ProxyPass "/" "balancer://mycluster/" ProxyPassReverse "/" "balancer://mycluster/"</VirtualHost># Requires: a2enmod proxy proxy_http proxy_balancer lbmethod_byrequests
TLS Hardening & HSTS
Restrict protocols/ciphers and force HTTPS via strict transport security.
apache
<VirtualHost *:443> ServerName example.com SSLEngine on SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem SSLProtocol -all +TLSv1.2 +TLSv1.3 SSLCipherSuite HIGH:!aNULL:!MD5:!3DES SSLHonorCipherOrder on Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" Header always set X-Content-Type-Options "nosniff"</VirtualHost># Requires: a2enmod ssl headers
Static Asset Caching
Set far-future expiry headers and enable server-side response caching.
apache
<IfModule mod_expires.c> ExpiresActive On ExpiresByType image/jpg "access plus 1 year" ExpiresByType text/css "access plus 1 month" ExpiresByType application/javascript "access plus 1 month"</IfModule><IfModule mod_cache.c> CacheQuickHandler off CacheLockPath /tmp/mod_cache-lock CacheRoot /var/cache/apache2/mod_cache_disk CacheEnable disk / CacheDirLevels 2 CacheDirLength 1</IfModule># Requires: a2enmod expires cache cache_disk
Access Control & Hardening
Directives and modules that gate access and reduce information leakage.
- Require ip 10.0.0.0/8- New-style (2.4+) access control restricting a location to a CIDR range
- AuthType Basic / AuthUserFile- Enable HTTP Basic auth backed by a htpasswd-generated credentials file
- ServerTokens Prod / ServerSignature Off- Suppress Apache version and build details from error pages and the Server header
- mod_security- Web application firewall module that evaluates requests against OWASP Core Rule Set signatures
- LimitRequestBody- Caps request payload size per directory to blunt large-upload DoS attempts
- Header set X-Frame-Options SAMEORIGIN- Mitigates clickjacking by restricting which origins may frame the response
- <FilesMatch "\.(env|git)">Require all denied</FilesMatch>- Blocks direct access to sensitive dotfiles accidentally left in the document root
Pro Tip
Run 'apachectl configtest' before every reload, and prefer 'AllowOverride None' with directives moved into the vhost config instead of .htaccess for better performance, since Apache re-reads .htaccess on every request.
Was this cheat sheet helpful?
Explore Topics
#ApacheHTTPServer#ApacheHTTPServerCheatSheet#DevOps#Intermediate#VirtualHost#ReverseProxy#URLRewriting#CLIModuleManagement#Networking#CheatSheet#SkillVeris
