Advanced Apache Web Server Configuration

In this tutorial we'll discuss advanced Apache web server configuration to enhance performance and security.

We understand that optimizing the Apache web server is crucial for delivering faster, more secure websites. While the basic setup works for most websites, advanced configuration options can help fine-tune performance and enhance security. In this tutorial, we will walk through advanced techniques that can significantly boost your Apache server’s performance and security.

Prerequisites

Before proceeding, make sure you have the following in place:

• A Linux dedicated server or KVM VPS.
• Root or Sudo Privileges: You should have sudo privileges to install packages and make system-wide changes.
• Apache installed.

1. Optimize Apache’s Worker MPM (Multi-Processing Module)

The Multi-Processing Module (MPM) determines how Apache handles requests. There are several MPMs available, including worker, event, and prefork. Depending on the type of server and its workload, configuring the correct MPM can have a significant impact on performance.

• Event MPM: Best suited for modern servers, especially those running high traffic websites. It uses fewer resources by handling keep-alive connections more efficiently. We recommend enabling the event MPM for high-performance setups.
• Worker MPM: A balance between performance and compatibility, suitable for multi-threaded environments.
• Prefork MPM: Ideal for compatibility with older software, but not the best for performance-heavy websites.

To change the MPM, open the Apache configuration file (httpd.conf) and adjust the following:

LoadModule mpm_event_module modules/mod_mpm_event.so

Or, use the mpm_worker or mpm_prefork module as needed.

2. Enable HTTP/2 for Faster Connections

HTTP/2 is a major revision of the HTTP protocol that can greatly improve the speed and efficiency of web communication. Apache supports HTTP/2, which allows browsers to multiplex multiple requests over a single connection, reducing latency.

To enable HTTP/2 in Apache, ensure that the following modules are enabled:

LoadModule http2_module modules/mod_http2.so

Then, in your virtual host configuration, enable HTTP/2:

Protocols h2 http/1.1

Make sure your server is also running over HTTPS (SSL/TLS), as HTTP/2 requires SSL for optimal performance.

3. Configure Keep-Alive for Persistent Connections

The KeepAlive directive allows Apache to reuse existing connections for multiple requests, reducing the overhead of opening new connections for each request. By adjusting the KeepAlive settings, we can optimize how long the server keeps connections open.

In the Apache configuration file, set:

KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5

• KeepAlive: Ensures connections are reused.
• MaxKeepAliveRequests: Limits the number of requests that can be sent over a single connection (a higher value allows more requests).
• KeepAliveTimeout: Defines how long Apache will wait for further requests on an open connection. A lower value improves performance, but too low can cause issues.

4. Leverage Caching with mod_cache

Caching content helps reduce server load and improves response times by serving static files without requiring Apache to process every request. Apache’s mod_cache allows for efficient caching of dynamic content, which is particularly useful for websites with large amounts of frequently accessed data.

Here’s how to enable caching in Apache:

LoadModule cache_module modules/mod_cache.so
LoadModule cache_disk_module modules/mod_cache_disk.so

Then, configure caching settings in your virtual host:

CacheEnable disk /
CacheRoot /var/cache/apache2
CacheMaxFileSize 1000000

This setup will cache static files to disk and allow for faster delivery to users.

5. Enable Mod_Deflate for Content Compression

Compressing content before sending it to users reduces bandwidth usage and speeds up page load times. The mod_deflate module enables compression for various file types.

To enable compression, add the following to the Apache configuration:

LoadModule deflate_module modules/mod_deflate.so

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/javascript
</IfModule>

This configuration will compress text-based files, such as HTML, CSS, and JavaScript, reducing file sizes and improving page load speeds.

6. Enhance Security with mod_security

Apache's mod_security module acts as a web application firewall (WAF) to protect against various types of attacks, including SQL injection, cross-site scripting (XSS), and other common exploits. By configuring mod_security, we can significantly reduce the risk of malicious attacks on the server.

To install and enable mod_security, run:

sudo apt-get install libapache2-mod-security2
sudo a2enmod security2

Then, configure mod_security in the Apache configuration file (/etc/modsecurity/modsecurity.conf):

SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess Off

7. Limit Resource Usage with mod_ratelimit

To prevent abuse and protect the server from heavy traffic or DoS (Denial of Service) attacks, we can limit the rate at which clients can download data. The mod_ratelimit module allows us to define download and upload speed limits.

To enable mod_ratelimit:

LoadModule ratelimit_module modules/mod_ratelimit.so

Then, add the following directive to the configuration:

SetOutputFilter RATE_LIMIT
SetEnv rate-limit 400

This configuration will limit the download speed to 400 KB per second for all users. Adjust the rate as needed for your server.

8. Harden Apache Configuration for Security

In addition to enabling mod_security, we can enhance Apache’s security by configuring various security-focused directives:

Hide Apache Version: To prevent attackers from knowing which version of Apache is running, set:

ServerTokens Prod
ServerSignature Off

Disable Directory Listings: Prevent users from viewing directory contents by disabling directory indexing:

Options -Indexes

Restrict Access to Sensitive Files: Prevent access to configuration files, such as .htaccess and .env, by adding the following:

<FilesMatch "^\.">
    Require all denied
</FilesMatch>

Limit Request Size: Limit the size of incoming requests to prevent certain types of DoS attacks:

LimitRequestBody 10485760

9. Enable SSL/TLS for Secure Connections

SSL/TLS encryption is essential for securing data transfer between the client and server. We strongly recommend enabling SSL/TLS to protect sensitive information such as login credentials, payment details, and personal data.

To enable SSL, ensure the following modules are enabled:

LoadModule ssl_module modules/mod_ssl.so

Then, configure SSL in your virtual host:

<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile /path/to/certificate.crt
    SSLCertificateKeyFile /path/to/private.key
</VirtualHost>

Additionally, we recommend using a strong SSL configuration and enforcing strong ciphers:

SSLCipherSuite HIGH:!aNULL:!MD5:!3DES
SSLProtocol TLSv1.2 TLSv1.3

Conclusion

By configuring Apache with these advanced settings, web hosting providers can offer a more efficient and secure service to their clients. These optimizations can lead to faster website performance, reduced server load, and enhanced protection against security threats. We recommend regularly revisiting Apache’s configuration to ensure that it continues to meet performance and security standards.