Comprehensive Guide for Setting Up Apache Web Server on Linux

• Install apache2 on Debian/Ubuntu, httpd on RHEL-based systems. Service names differ accordingly.
• Use MPM event with PHP-FPM via proxy_fcgi. This combination provides the best performance and resource isolation.
• HTTP/2 is enabled by default on most modern distributions. HTTP/3 remains experimental for Apache as of version 2.4.65-use a reverse proxy like Nginx 1.25+, Caddy, or a CDN for QUIC/HTTP/3.
• Use Let’s Encrypt with certbot. Auto-renewal runs via systemd timer or cron.
• Configure TLS for TLS 1.2 and 1.3 only. Add security headers.
• Open only ports 80 and 443 in your firewall.
• Verify every step with systemctl, apachectl -t, and curl.

apachectl -v
openssl version
hostname -I
dig +short A example.com   # or AAAA for IPv6

sudo apt update
sudo apt install -y apache2
sudo systemctl enable --now apache2

systemctl status apache2 --no-pager
apachectl -v
curl -I http://localhost

sudo dnf install -y httpd
sudo systemctl enable --now httpd

systemctl status httpd --no-pager
httpd -v
curl -I http://localhost

sudo dnf install -y httpd
sudo systemctl enable --now httpd

sudo zypper install -y apache2
sudo systemctl enable --now apache2

sudo pacman -Syu --noconfirm apache
sudo systemctl enable --now httpd

# AL2
sudo yum install -y httpd
# AL2023
sudo dnf install -y httpd
sudo systemctl enable --now httpd

# Always test before reloading
sudo apachectl -t

# Alternative syntax
sudo apachectl configtest

# Show parsed configuration
sudo apachectl -t -D DUMP_RUN_CFG

# List loaded modules
sudo apachectl -M

# Show virtual host configuration
sudo apachectl -S

/etc/apache2/
├── apache2.conf          # Main configuration
├── ports.conf            # Port bindings
├── sites-available/      # Virtual host definitions
├── sites-enabled/        # Enabled virtual hosts (symlinks)
├── mods-available/       # Available modules
├── mods-enabled/         # Enabled modules (symlinks)
└── envvars              # Environment variables

/etc/httpd/
├── conf/
│   └── httpd.conf        # Main configuration
├── conf.d/               # Additional configuration
└── conf.modules.d/       # Module loading

/etc/apache2/
├── httpd.conf            # Main configuration
├── conf.d/               # Additional configuration
└── vhosts.d/             # Virtual host definitions

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/example

    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    ErrorLog ${APACHE_LOG_DIR}/example_error.log
    CustomLog ${APACHE_LOG_DIR}/example_access.log combined
</VirtualHost>

sudo a2enmod rewrite
sudo a2ensite example-http
sudo apachectl -t && sudo systemctl reload apache2

Listen 192.0.2.10:80

<VirtualHost 192.0.2.10:80>
    ServerName app.example.com
    DocumentRoot /var/www/app
    ErrorLog ${APACHE_LOG_DIR}/app_error.log
    CustomLog ${APACHE_LOG_DIR}/app_access.log combined
</VirtualHost>

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/example

    <Directory "/var/www/example">
        Options -Indexes -Includes -ExecCGI
        AllowOverride None
        Require all granted
    </Directory>

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

    # Strong TLS
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
    TLSCipherSuite TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256
    SSLHonorCipherOrder off

    # OCSP Stapling
    SSLUseStapling on
    SSLStaplingCache shmcb:/var/run/ocsp(128000)

    # HTTP/2
    Protocols h2 http/1.1

    ErrorLog ${APACHE_LOG_DIR}/example_ssl_error.log
    CustomLog ${APACHE_LOG_DIR}/example_ssl_access.log combined
</VirtualHost>

sudo snap install core && sudo snap refresh core
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

# Install from distribution repository
sudo dnf install -y certbot python3-certbot-apache   # RHEL/Fedora
sudo zypper install -y certbot                       # openSUSE
sudo pacman -S certbot                               # Arch

sudo certbot --apache -d example.com -d www.example.com

sudo certbot certonly --webroot -w /var/www/example -d example.com -d www.example.com
sudo systemctl reload apache2   # or httpd

openssl s_client -connect example.com:443 -servername example.com -status | grep -E "Protocol|Cipher|issuer|Verify return code|OCSP"

# Test renewal
sudo certbot renew --dry-run

# Check timer
systemctl list-timers | grep -i certbot

curl -I --http2 https://example.com
openssl s_client -alpn h2 -connect example.com:443 -servername example.com | grep -i alpn

sudo apt update
sudo apt install -y php8.3-fpm

# Enable modules
sudo a2enmod proxy proxy_fcgi setenvif
sudo a2dismod mpm_prefork
sudo a2enmod mpm_event

# Create PHP-FPM configuration
sudo tee /etc/apache2/conf-available/php8.3-fpm.conf >/dev/null <<'EOF'
<FilesMatch "\.php$">
    SetHandler "proxy:unix:/run/php/php8.3-fpm.sock|fcgi://localhost/"
</FilesMatch>
DirectoryIndex index.php index.html

<Files "\.(env|ini|log|sh|sql|tpl|twig|yml)$">
    Require all denied
</Files>
EOF

sudo a2enconf php8.3-fpm
sudo systemctl enable php8.3-fpm
sudo systemctl start php8.3-fpm
sudo apachectl -t && sudo systemctl restart apache2

sudo dnf install -y php-fpm

sudo tee /etc/httpd/conf.d/php-fpm.conf >/dev/null <<'EOF'
<FilesMatch "\.php$">
    SetHandler "proxy:unix:/run/php-fpm/www.sock|fcgi://localhost/"
</FilesMatch>
DirectoryIndex index.php index.html

<Files "\.(env|ini|log|sh|sql|tpl|twig|yml)$">
    Require all denied
</Files>
EOF

sudo systemctl enable php-fpm
sudo systemctl start php-fpm
sudo apachectl -t && sudo systemctl restart httpd

sudo zypper install -y php8-fpm

sudo tee /etc/apache2/conf.d/php-fpm.conf >/dev/null <<'EOF'
<FilesMatch "\.php$">
    SetHandler "proxy:unix:/run/php8-fpm.sock|fcgi://localhost/"
</FilesMatch>
DirectoryIndex index.php index.html
EOF

sudo a2enmod proxy proxy_fcgi
sudo systemctl enable php8-fpm
sudo systemctl start php8-fpm
sudo apachectl -t && sudo systemctl restart apache2

sudo pacman -Syu --noconfirm php php-fpm

sudo tee /etc/httpd/conf/extra/php-fpm.conf >/dev/null <<'EOF'
<FilesMatch "\.php$">
    SetHandler "proxy:unix:/run/php-fpm/php-fpm.sock|fcgi://localhost/"
</FilesMatch>
DirectoryIndex index.php index.html
EOF

echo "Include conf/extra/php-fpm.conf" | sudo tee -a /etc/httpd/conf/httpd.conf
sudo systemctl enable php-fpm
sudo systemctl start php-fpm
sudo apachectl -t && sudo systemctl restart httpd

pm = dynamic
pm.max_children = 30
pm.start_servers = 4
pm.min_spare_servers = 2
pm.max_spare_servers = 8
pm.max_requests = 500

listen = /run/php/php8.3-fpm.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660

request_terminate_timeout = 60s
request_slowlog_timeout = 30s

sudo a2enmod proxy proxy_http proxy_balancer lbmethod_byrequests headers
sudo a2enmod proxy_hcheck proxy_wstunnel slotmem_shm remoteip
sudo apachectl -t && sudo systemctl reload apache2

ProxyPass "/" "http://127.0.0.1:8080/"
ProxyPassReverse "/" "http://127.0.0.1:8080/"
ProxyPreserveHost On
ProxyTimeout 60
ProxyRequests Off

<Proxy "balancer://appcluster">
    BalancerMember "http://10.0.0.11:8080" hcheck=on hcinterval=30
    BalancerMember "http://10.0.0.12:8080" hcheck=on hcinterval=30
    BalancerMember "http://10.0.0.13:8080" hcheck=on hcinterval=30 status=+H
    ProxySet lbmethod=byrequests
</Proxy>

ProxyPass "/" "balancer://appcluster/"
ProxyPassReverse "/" "balancer://appcluster/"

LoadModule remoteip_module modules/mod_remoteip.so

RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy 10.0.0.0/8
RemoteIPInternalProxy 172.16.0.0/12
RemoteIPInternalProxy 192.168.0.0/16

ProxyPass "/ws/" "ws://127.0.0.1:9000/"
ProxyPassReverse "/ws/" "ws://127.0.0.1:9000/"

# Alternative with rewrite
RewriteEngine On
RewriteCond %{HTTP:Upgrade} websocket [NC]
RewriteCond %{HTTP:Connection} upgrade [NC]
RewriteRule "^/ws/(.*)" "ws://127.0.0.1:9000/$1" [P,L]

# Enable headers module
# Debian/Ubuntu: sudo a2enmod headers
# RHEL/Fedora: LoadModule headers_module modules/mod_headers.so

# Basic headers
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# HSTS - start conservative, then increase
Header always set Strict-Transport-Security "max-age=86400"
# After verification: max-age=31536000; includeSubDomains

# Permissions-Policy (experimental)
Header always set Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=()"

# Server information
ServerTokens Prod
ServerSignature Off
Header always unset X-Powered-By

<Directory "/var/www/html">
    Options -Indexes -Includes -ExecCGI
    AllowOverride None
    Require all granted

    <FilesMatch "\.(env|ini|conf|config|log|sh|sql|tpl|twig|yml|yaml|bak|backup|swp)$">
        Require all denied
    </FilesMatch>

    <FilesMatch "^\.">
        Require all denied
    </FilesMatch>
</Directory>

# Protect uploads directory from PHP execution
<Directory "/var/www/html/uploads">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>

<LimitExcept GET POST HEAD>
    Require all denied
</LimitExcept>

TraceEnable Off

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
TLSCipherSuite TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256
SSLHonorCipherOrder off
SSLSessionTickets off

SSLUseStapling on
SSLStaplingResponderTimeout 5
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"

sudo apt install -y libapache2-mod-security2 modsecurity-crs
sudo a2enmod security2

sudo dnf install -y mod_security mod_security_crs

sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

SecRuleEngine DetectionOnly   # Start in detection-only mode
SecRequestBodyLimit 134217728 # 128MB

sudo setsebool -P httpd_can_network_connect on
sudo setsebool -P httpd_execmem on
sudo setsebool -P httpd_unified on
sudo ausearch -m avc -ts recent   # Check for denials

sudo aa-status
sudo aa-complain apache2   # Temporarily complain mode for testing
sudo aa-enforce apache2    # Re-enforce

sudo apt install -y fail2ban   # Debian/Ubuntu
sudo dnf install -y fail2ban   # RHEL/Fedora

sudo tee /etc/fail2ban/jail.d/apache.conf >/dev/null <<'EOF'
[apache-auth]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/apache2/*error.log
maxretry = 3
bantime = 3600
findtime = 600

[apache-badbots]
enabled = true
port = http,https
filter = apache-badbots
logpath = /var/log/apache2/*access.log
maxretry = 2
bantime = 86400
findtime = 600
EOF

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

sudo ufw allow "Apache Full"
sudo ufw status

sudo firewall-cmd --add-service=http --add-service=https --permanent
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

sudo nft add table inet filter
sudo nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
sudo nft add rule inet filter input ct state established,related accept
sudo nft add rule inet filter input iif lo accept
sudo nft add rule inet filter input tcp dport {80,443} accept

sudo a2dismod mpm_prefork
sudo a2enmod mpm_event
sudo systemctl restart apache2

<IfModule mpm_event_module>
    StartServers 2
    MinSpareThreads 25
    MaxSpareThreads 75
    ThreadsPerChild 25
    MaxRequestWorkers 150
    MaxConnectionsPerChild 0
</IfModule>

KeepAlive On
KeepAliveTimeout 2
MaxKeepAliveRequests 100

# Check current limits
ulimit -n

# System-wide limits (Debian/Ubuntu)
# /etc/security/limits.conf
www-data soft nofile 65536
www-data hard nofile 65536

# Systemd service override
sudo systemctl edit apache2
[Service]
LimitNOFILE=65536

# Gzip
AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml
DeflateCompressionLevel 6

# Skip already-compressed formats
SetEnvIfNoCase Request_URI "\.(?:jpg|jpeg|png|gif|webp|avif|zip|gz|bz2|7z)$" no-gzip

# Brotli (if available)
AddOutputFilterByType BROTLI_COMPRESS text/html text/css application/javascript application/json image/svg+xml

LoadModule cache_module modules/mod_cache.so
LoadModule cache_disk_module modules/mod_cache_disk.so

CacheQuickHandler on
CacheEnable disk "/"
CacheLock on
CacheDefaultExpire 300

# Far-future caching for versioned assets
<Location "/assets/">
    ExpiresActive On
    ExpiresDefault "access plus 1 year"
    Header set Cache-Control "public, max-age=31536000, immutable"
</Location>

# Enable status module
# Debian/Ubuntu: sudo a2enmod status

<Location "/server-status">
    SetHandler server-status
    Require ip 192.168.1.0/24
    Require local
</Location>

ExtendedStatus On

sudo ss -tulpn | grep :80
sudo ps aux | grep apache
sudo top -p $(pgrep -d',' -f apache)

# Real-time log monitoring
sudo tail -F /var/log/apache2/*.log /var/log/httpd/*log

# Systemd journal
sudo journalctl -u apache2 -f

sudo apt install -y goaccess   # Debian/Ubuntu
sudo dnf install -y goaccess   # RHEL/Fedora

sudo goaccess /var/log/apache2/access.log -o report.html --log-format=COMBINED

sudo tee /etc/logrotate.d/apache2-custom >/dev/null <<'EOF'
/var/log/apache2/*.log {
    daily
    missingok
    rotate 52
    compress
    delaycompress
    notifempty
    create 644 root adm
    sharedscripts
    postrotate
        systemctl reload apache2 > /dev/null 2>&1 || true
    endscript
}
EOF

#!/bin/bash
BACKUP_DIR="/root/apache-backups"
DATE=$(date +%Y%m%d_%H%M%S)
CONFIG_DIR=""

mkdir -p "$BACKUP_DIR/$DATE"

if [[ -d "/etc/apache2" ]]; then CONFIG_DIR="/etc/apache2"
elif [[ -d "/etc/httpd" ]]; then CONFIG_DIR="/etc/httpd"
else echo "ERROR: No config dir" && exit 1; fi

cp -r "$CONFIG_DIR" "$BACKUP_DIR/$DATE/"
if [[ -d "/etc/letsencrypt" ]]; then cp -r /etc/letsencrypt "$BACKUP_DIR/$DATE/"; fi

tar -czf "$BACKUP_DIR/apache_backup_$DATE.tar.gz" -C "$BACKUP_DIR/$DATE" .
find "$BACKUP_DIR" -name "apache_backup_*.tar.gz" -mtime +30 -delete

sudo systemctl stop apache2
sudo tar -xzf /root/apache-backups/apache_backup_latest.tar.gz -C /
sudo apachectl -t
sudo systemctl start apache2

# Test security headers
curl -I https://example.com

# SSL/TLS testing
openssl s_client -connect example.com:443 -servername example.com

# Test with OWASP dependency-check or nikto
nikto -h https://example.com

# Check for open ports
sudo netstat -tulpn | grep :80
sudo netstat -tulpn | grep :443

# Verify file permissions
sudo find /var/www/html -type f -perm /o=w -ls

1. Installation varies by distribution. Use apache2 on Debian/Ubuntu/openSUSE, httpd on RHEL/Fedora/Arch/Amazon.
2. Use MPM event with PHP-FPM. This combination provides better performance and resource isolation than mod_php with MPM prefork.
3. HTTP/2 is available; HTTP/3 is not. As of Apache 2.4.65, HTTP/3 is experimental. Use Nginx, Caddy, or a CDN for QUIC.
4. Use Let’s Encrypt with certbot. Auto-renewal runs via systemd timer. Verify renewal with certbot renew --dry-run.
5. Test every configuration change. sudo apachectl -t prevents service disruption.
6. Security is layered. Combine security headers, directory protection, SELinux/AppArmor, and ModSecurity for defense in depth.
7. Monitor regularly. Use status module, logs, and GoAccess. Back up configuration files. Document recovery procedures.

• Apache httpd 2.4 docs and module references
• RHEL Apache admin docs
• Ubuntu Server Guide for Apache
• openSUSE Apache guide
• ArchWiki Apache
• Certbot instructions and auto-renew details
• mod_cache and CacheQuickHandler
• mod_brotli and mod_deflate
• mod_proxy, mod_proxy_hcheck, mod_proxy_wstunnel
• mod_remoteip
• Apache mod_http2 documentation
• Mozilla SSL Configuration Generator
• CIS Apache HTTP Server Benchmark
• OWASP Secure Headers Project
• UFW usage
• OpenWrt port forwarding
• AWS security group examples
• Apache HTTP Server Documentation
• Let’s Encrypt Documentation
• Certbot Documentation
• ModSecurity Documentation
• Mozilla SSL Configuration Generator