Apache HTTP Server, usually called httpd, is a free, open-source web server developed under the Apache Software Foundation. It receives HTTP requests and answers them with files from disk, output from programs, or responses fetched from other servers. It runs on Linux, Windows, macOS and most other Unix-like systems. The project itself releases source code. Ready-made Windows builds come from third-party distributions. They can run in a console window or as a Windows service. Administrators control Apache through plain-text configuration files and command-line tools. It has no graphical interface.
Processing models (MPMs)
A multi-processing module decides how Apache accepts connections and spreads work across processes and threads. Apache loads exactly one at a time. On Unix-like systems there are three choices:
- prefork uses many single-threaded processes, for stability and for older code that is not thread-safe.
- worker runs several threads inside each process to handle more connections with fewer resources.
- event is threaded like worker and handles idle keep-alive connections more efficiently. It is the default on modern systems.
Windows uses its own threaded model.
Loadable modules
Most of what Apache HTTP Server does comes from modules. Over a hundred ship with it, covering rewriting, proxying, load balancing, scripting and more. Administrators enable modules in the configuration with LoadModule. They can add third-party modules later with the bundled apxs tool without rebuilding the server.
Configuration files and .htaccess
The main configuration file is read once at startup. Sections such as <Directory>, <Location> and <VirtualHost> scope settings. A rule can apply to the whole server, one folder or one site.
Apache can also read .htaccess files placed inside content folders. This lets site owners on shared hosting change behavior without access to the main configuration. They are off by default: the administrator decides with AllowOverride which directives are permitted. Apache checks for them on every request, so enabling them slows the server even where none exist.
Virtual hosts
A single Apache server can host many websites. Name-based virtual hosts share one IP address, and the server picks the site from the host name the browser sends. IP-based hosts give each site its own address. Each <VirtualHost> block can have its own document folder, logs, certificates and rules.
HTTPS and HTTP/2
mod_ssl handles encryption. Administrators enable it per virtual host with a certificate and private key. Administrators choose the allowed TLS protocols and cipher suites, can require client certificates, and can enable OCSP stapling. The mod_md module, still marked experimental, obtains and renews certificates automatically from Let’s Encrypt or another ACME authority.
mod_http2 adds HTTP/2 both over TLS and over plain connections, selected with the Protocols directive. It works best with the event MPM.
Authentication and access control
Apache can password-protect any folder or URL. Usernames and passwords can come from a text file created with htpasswd, a DBM file, an SQL database or an LDAP directory. Access rules use Require lines: a specific user, a group, any logged-in user, or client IP addresses and host names. Containers such as <RequireAll> and <RequireAny> combine conditions.
URL rewriting
mod_rewrite changes request URLs with rules based on regular expressions. The target can be a file path, another path on the site, or a full URL sent to the browser as a redirect. Conditions placed before a rule can test values such as a cookie or the query string.
Reverse proxy and load balancing
Apache HTTP Server often sits in front of application servers. With ProxyPass, Apache forwards a URL path to a backend and returns the reply as if Apache produced it. ProxyPassReverse fixes redirects that point to the backend.
A balancer groups several backends under one name. The distribution method can be by request count, by bytes transferred, by fewest pending requests, or by load reports sent from the backends. Further options include:
- Sticky sessions, so a user keeps reaching the same backend.
- Hot spares and standbys that take over when regular members fail.
- Health checks before each request or in the background.
- A web-based balancer manager for viewing members and changing their status while the server runs.
Response caching
mod_cache is an HTTP-aware cache that follows headers like Cache-Control and Expires. The cache serves fresh entries without contacting the origin and revalidates stale ones. Storage is on disk or in shared memory or memcache.
Running scripts and applications
Apache runs CGI programs in any language. A script receives request details in environment variables and form data on standard input. Its output goes to the browser. Folders are marked for scripts with ScriptAlias or the ExecCGI option. PHP-FPM and other FastCGI applications are reached through the proxy modules.
Error and access logs
The error log records startup problems and request failures. Access logs use formats built from tokens for the client, request, status, size and any header. The common and combined formats are predefined. Entries can be piped to the bundled rotatelogs tool, which starts new files by time or size.
