Apache, formally the Apache HTTP Server and often called httpd, is an open-source web server maintained by the Apache Software Foundation. Among web servers, it is known for its modular architecture, its per-directory configuration through .htaccess files and decades of use on Linux hosting platforms.
Apache accepts HTTP and HTTPS requests, maps them to files or application handlers and returns responses. Its behavior is defined almost entirely by loadable modules and by directives in configuration files, which makes it highly adaptable but also more complex to tune than lighter servers.
How Apache processes requests
Apache processes each request through a sequence of hook phases: URL translation, access control, authentication, MIME type detection, content generation and logging. Modules register functions for these phases, so features such as rewriting, compression or authentication are added by enabling a module rather than changing the core.
Concurrency is handled by a Multi-Processing Module (MPM), and exactly one MPM is active at a time. The choice of MPM determines how many requests Apache can hold open and how much memory it uses.
| MPM | Concurrency model | Strength | Limitation |
|---|---|---|---|
| prefork | One process per connection, no threads | Safe for non-thread-safe modules such as mod_php | High memory use under many connections |
| worker | Several processes, many threads each | Much lower memory per connection | Keep-alive connections occupy threads |
| event | Threads plus a listener for idle keep-alive | Best scalability, default on most modern builds | Requires thread-safe modules |
The event MPM is the usual recommendation today. It hands idle keep-alive connections to a dedicated listener thread, so worker threads are used only while a request is actually being processed.
Configuration, virtual hosts and .htaccess
Apache configuration is built from directives in a main file such as httpd.conf or apache2.conf, plus included files for modules and sites. Directives can be scoped to containers such as VirtualHost, Directory, Location and Files.
Name-based virtual hosts let one Apache instance serve many domains on a single IP address, selecting the site by the Host header or, for HTTPS, by the SNI value in the TLS handshake. Each virtual host has its own document root, logs and certificate.
.htaccess files allow per-directory overrides without access to the main configuration, which is why shared hosting relies on them. The cost is performance: when AllowOverride is enabled, Apache checks every parent directory for .htaccess on each request. Where administrators control the main configuration, moving rules there and setting AllowOverride None is faster and easier to audit.
Important Apache modules
Most practical Apache features come from standard modules shipped with the server. The table lists the ones that appear in nearly every production setup.
| Module | Purpose | Typical use |
|---|---|---|
| mod_rewrite | Rule-based URL rewriting | Clean URLs, redirects, front-controller routing |
| mod_ssl | TLS support | HTTPS with certificates per virtual host |
| mod_proxy and mod_proxy_fcgi | Proxying to other servers | Passing PHP to PHP-FPM, reverse proxy to applications |
| mod_headers | Edit request and response headers | Security headers and cache control |
| mod_deflate or mod_brotli | Response compression | Smaller HTML, CSS and JavaScript transfers |
| mod_http2 | HTTP/2 protocol | Multiplexed requests over one connection |
For PHP, the modern pattern is event MPM with PHP-FPM through FastCGI, instead of the older prefork MPM with mod_php embedded in every process. Separating PHP into its own pool reduces memory use and allows different PHP versions per site.
Apache compared with other web servers
Apache is usually compared with Nginx, Caddy and OpenLiteSpeed, which emerged later with event-driven designs. The differences matter most in configuration style and in serving many concurrent connections.
| Aspect | Apache | Nginx | Caddy | OpenLiteSpeed |
|---|---|---|---|---|
| Architecture | Modular, choice of MPM | Event-driven workers | Event-driven, written in Go | Event-driven |
| Per-directory overrides | .htaccess supported | Not supported | Not supported | Partial .htaccess support |
| Automatic HTTPS | Through mod_md or external tools | External tools | Built in by default | Built-in options |
| Static file efficiency | Good with event MPM | Very high | High | High |
| Typical role | Shared hosting, legacy apps | Reverse proxy, high traffic | Simple secure sites | PHP hosting with caching |
A common combination places Nginx in front as a reverse proxy for TLS and static files, with Apache behind it for applications that depend on .htaccess rules. This hybrid adds a hop but keeps compatibility.
Tuning and security pitfalls
- MaxRequestWorkers set too high: the server runs out of memory and starts swapping, which is worse than queuing requests.
- KeepAliveTimeout too long with prefork: idle clients hold whole processes; a few seconds is usually enough.
- Version disclosure: ServerTokens Prod and ServerSignature Off hide version details from error pages and headers.
- Directory listing left on: Options -Indexes prevents Apache from listing files where no index page exists.
- Unused modules loaded: each enabled module enlarges the attack surface and memory footprint.
After any change, apachectl configtest validates the syntax, and a graceful reload applies the new configuration without dropping active connections.
In plain words
Apache is a program that answers requests from web browsers. When someone opens a page, Apache finds the right file or asks the right application, then sends the result back.
It is like a switchboard operator with a toolbox. The basic operator only connects calls. Each tool added to the box teaches it a new skill, such as securing the connection or shortening web addresses.
A real-world example
A small hosting company runs about 200 customer websites, mostly PHP content management systems, on two Linux servers. Customers need to set their own redirects and access rules, so the company uses Apache with .htaccess enabled for customer directories.
The servers originally used prefork with mod_php and regularly ran out of memory during traffic peaks. The administrators switched to the event MPM with PHP-FPM, giving each customer a separate pool with its own PHP version and memory limit. Memory use under the same load fell substantially, one compromised site could no longer read another customer’s files, and peak-hour failures stopped. Customer .htaccess rules kept working without any changes.