Apache HTTP Server
The Apache HTTP Server is an open-source web server that has served a large share of the web since 1995. It handles HTTP requests using a modular architecture, supporting virtual hosts, URL rewriting, authentication, TLS, and reverse proxying through loadable modules.
itWeb servers, proxies, and traffic management | OpenSkills.info
Intro
Apache HTTP Server
Apache HTTP Server, often called httpd, accepts HTTP requests and produces HTTP responses. It can serve files, run content handlers, terminate TLS, and forward traffic to application backends.
The useful mental model is a modular request-processing engine. The core server handles the connection and coordinates the request. Loaded modules add capabilities at defined stages. Configuration directives decide which modules act, where they act, and which content or backend produces the response.
This model explains Apache httpd's range. One installation can host static sites, expose application handlers, enforce access rules, or work as a reverse proxy. It also explains the main operational risk: configuration from several scopes and modules can combine in ways you did not intend.
Where Apache httpd fits
Apache httpd sits between clients and content. A browser or API client connects to a listening address and port. The server selects a virtual host, maps the requested URL, applies the relevant configuration, and invokes modules or handlers. It then returns a status code, headers, and an optional body.
Common roles include:
- serving HTML, images, style sheets, and downloads from a document tree;
- hosting several DNS names on one server with virtual hosts;
- terminating TLS with
mod_ssl; - forwarding requests to application servers with
mod_proxy; - adding authentication, authorization, rewriting, compression, caching, and logging through modules;
- exposing server activity through a restricted
mod_statusendpoint.
Apache httpd is not an application runtime by itself. Dynamic content requires a handler, a gateway such as CGI or FastCGI, an embedded third-party module, or a separate application reached through a proxy.
The core, modules, and one MPM
The core contains only basic server functions. Modules provide most extended behavior. Some modules are compiled into the server. Others are dynamic shared objects loaded at startup with LoadModule.
You can inspect the active build instead of guessing:
httpd -l # statically compiled modules
httpd -M # loaded modules, including dynamic modules
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://httpd.apache.org/docs/2.4/
Supports
- Current Apache HTTP Server 2.4 documentation structure
- Reference paths for modules, directives, administration, user guides, tutorials, and platform notes
- https://httpd.apache.org/docs/2.4/getting-started.html
Supports
- Client, server, URL, request, response, status-code, and logging mental model
- Configuration file and Include variability across builds and distributions
- Static and dynamic content distinction
- DocumentRoot and index-file introductory behavior
- Error log as the first troubleshooting source
- https://httpd.apache.org/docs/2.4/configuring.html
Supports
- Plain-text directives, main configuration, Include, and restart activation
- Syntax testing with apachectl configtest and the t command option
- Core versus module capabilities and LoadModule behavior
- Static and dynamic module inspection options
- Directive scope and `.htaccess` request-time behavior
- https://httpd.apache.org/docs/2.4/dso.html
Supports
- Dynamic shared objects as separately built modules
- Static versus dynamic module inclusion
- LoadModule activation at startup or restart
- Third-party modules as code loaded into the server process
- https://httpd.apache.org/docs/2.4/mpm.html
Supports
- MPM responsibility for binding, accepting requests, and dispatching work
- Exactly one active MPM
- Process and thread distinctions among prefork, worker, and event
- MPM selection differences across operating systems and builds
- https://httpd.apache.org/docs/2.4/sections.html
Supports
- Filesystem, file, URL, virtual-host, proxy, and conditional containers
- Filesystem versus webspace security boundary
- Configuration section merge order
- One selected virtual host per request
- Module-owned configuration merging during request processing
- https://httpd.apache.org/docs/2.4/vhosts/
Supports
- Name-based and IP-based virtual hosts
- ServerName, ServerAlias, and VirtualHost concepts
- Parsed virtual-host inspection with the S command option
- https://httpd.apache.org/docs/2.4/urlmapping.html
Supports
- Default URL-path append behavior under DocumentRoot
- Per-virtual-host document roots
- Alias, redirects, reverse proxy, rewrite, and handlers as alternate mappings
- DirectoryIndex selection for directory requests
- https://httpd.apache.org/docs/2.4/howto/htaccess.html
Supports
- Per-directory delegated configuration purpose
- AllowOverride and AllowOverrideList authorization
- Preference for main configuration when administrators have access
- Request-time filesystem search and performance cost
- Security implications of delegated configuration authority
- https://httpd.apache.org/docs/2.4/programs/apachectl.html
Supports
- apachectl as a front end to the httpd daemon
- Configuration testing behavior
- Graceful restart and graceful stop behavior
- Difference between graceful and ordinary restart for open connections
- Build-dependent command and file paths
- https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html
Supports
- Reverse-proxy role and backend isolation
- ProxyPass request mapping
- ProxyPassReverse redirect-header rewriting
- Balancers, members, failover, health checks, and balancer-manager restrictions
- https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html
Supports
- Minimal mod_ssl virtual-host shape
- Certificate and private-key directives
- Cipher policy, OCSP stapling, client authentication, access control, and TLS logging topics
- Need for deeper production policy beyond the minimal example
- https://httpd.apache.org/docs/2.4/logs.html
Supports
- Error log as the primary startup and request diagnostic source
- Access logs through CustomLog and LogFormat
- Per-module LogLevel configuration
- Access and error log correlation identifiers
- Log-directory ownership risk and untrusted raw log content
- https://httpd.apache.org/docs/2.4/mod/mod_status.html
Supports
- Active and idle worker, traffic, uptime, CPU, client, and request status data
- Human-readable and machine-readable status endpoints
- Status endpoint access-control requirements
- Use of status data in resource troubleshooting
- https://httpd.apache.org/docs/2.4/misc/security_tips.html
Supports
- Update requirements across server, add-ons, applications, and operating system
- Protection of executable, configuration, and log paths from untrusted writes
- Unprivileged request-serving process model
- Request timeouts, request-size limits, MaxRequestWorkers, and MPM considerations
- Resource-exhaustion limits and tradeoffs
