Apache Web Server
Cheatsheet

# Install (Ubuntu / Debian)
sudo apt update && sudo apt install apache2

# Service management (systemd)
sudo systemctl start apache2        # start
sudo systemctl stop apache2         # stop
sudo systemctl restart apache2      # restart (applies config changes)
sudo systemctl reload apache2       # graceful reload (no downtime)
sudo systemctl enable apache2       # start on boot
sudo systemctl disable apache2      # don't start on boot
sudo systemctl status apache2       # check status

# Legacy service command
sudo service apache2 restart

# Test configuration before reloading
sudo apache2ctl configtest          # check for syntax errors
sudo apache2ctl -t                  # same as configtest
sudo apache2ctl -M                  # list loaded modules
sudo apache2ctl -S                  # show virtual host settings

# Enable / disable sites and modules
sudo a2ensite mysite.conf           # enable virtual host
sudo a2dissite mysite.conf          # disable virtual host
sudo a2enmod rewrite                # enable mod_rewrite
sudo a2dismod status                # disable mod_status
sudo a2enmod ssl                    # enable SSL module
sudo a2enmod headers                # enable headers module
sudo systemctl reload apache2       # apply changes

# HTTP → HTTPS redirect (in port 80 vhost)
<VirtualHost *:80>
  ServerName example.com
  Redirect permanent / https://example.com/
</VirtualHost>

# OR with mod_rewrite (more flexible)
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Enable mod_rewrite
Options +FollowSymLinks
RewriteEngine On

# Remove .html extension from URLs
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}\.html -f
RewriteRule ^(.+)$ $1.html [L,QSA]

# Redirect old URL to new URL
Redirect 301 /old-page.html /new-page.html

# Block access to specific files
<Files "config.php">
  Require all denied
</Files>

# Block access to .env files
<FilesMatch "^\.env">
  Require all denied
</FilesMatch>

# Protect directory with password
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /etc/.htpasswd
Require valid-user

# Custom error pages
ErrorDocument 404 /errors/404.html
ErrorDocument 500 /errors/500.html

# Enable GZIP compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript
</IfModule>

# Set browser caching headers
<FilesMatch "\.(jpg|png|css|js)$">
  Header set Cache-Control "max-age=2592000, public"
</FilesMatch>

# Install certbot for Apache
sudo apt install certbot python3-certbot-apache

# Obtain and install certificate automatically
sudo certbot --apache -d example.com -d www.example.com

# Certificate only (no Apache config change)
sudo certbot certonly --apache -d example.com

# Renew all certificates
sudo certbot renew

# Test renewal (dry run)
sudo certbot renew --dry-run

# Cert locations (Let's Encrypt)
/etc/letsencrypt/live/example.com/fullchain.pem
/etc/letsencrypt/live/example.com/privkey.pem
/etc/letsencrypt/live/example.com/chain.pem

# Enable SSL module manually
sudo a2enmod ssl
sudo a2enmod headers
sudo systemctl restart apache2

# Enable required modules
sudo a2enmod proxy proxy_http proxy_wstunnel

# Basic reverse proxy in VirtualHost
<VirtualHost *:443>
  ServerName api.example.com
  SSLEngine on
  ...

  ProxyPreserveHost On
  ProxyPass / http://localhost:3000/
  ProxyPassReverse / http://localhost:3000/

  # WebSocket proxy
  RewriteEngine On
  RewriteCond %{HTTP:Upgrade} websocket [NC]
  RewriteRule /(.*) ws://localhost:3000/$1 [P,L]
</VirtualHost>

# In apache2.conf — hide version info
ServerTokens Prod
ServerSignature Off

# Disable directory listing globally
<Directory />
  Options -Indexes
</Directory>

# Security headers (mod_headers required)
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set X-XSS-Protection "1; mode=block"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Content-Security-Policy "default-src 'self'"
Header always set Strict-Transport-Security "max-age=63072000"

# Restrict HTTP methods
<LimitExcept GET POST HEAD>
  Require all denied
</LimitExcept>

# Block access to sensitive files
<FilesMatch "\.(htaccess|htpasswd|env|git|bak)$">
  Require all denied
</FilesMatch>

# Rate limiting (mod_ratelimit)
<Location />
  SetOutputFilter RATE_LIMIT
  SetEnv rate-limit 400
</Location>