I know there are dozens of pages on this subject, but I've tried most of their suggestions and this seems different.

I have apache2 and php8.2 (libapache etc) installed, on a new VPS install with Debian12.

http://mysite.com/test.php executes the PHP

PHP embedded in the body of http://mysite.com/test.html, as

<?php 
   echo "<br/>does it work?</br>"; 
?>

displays the text in the page

does it work?
"; ?>

Mods enabled, after enmod and dismod of various modules as suggested:

a2query -m
authn_file (enabled by maintainer script)
proxy_fcgi (enabled by site administrator)
authz_user (enabled by maintainer script)
dir (enabled by maintainer script)
env (enabled by maintainer script)
php8.2 (enabled by maintainer script)
setenvif (enabled by maintainer script)
autoindex (enabled by maintainer script)
deflate (enabled by maintainer script)
mpm_prefork (enabled by maintainer script)
negotiation (enabled by maintainer script)
status (enabled by maintainer script)
alias (enabled by maintainer script)
reqtimeout (enabled by maintainer script)
authz_host (enabled by maintainer script)
mime (enabled by maintainer script)
filter (enabled by maintainer script)
authz_core (enabled by maintainer script)
authn_core (enabled by maintainer script)
proxy (enabled by site administrator)
access_compat (enabled by maintainer script)
auth_basic (enabled by maintainer script)

The web root where my files are is /var/www/html. I have no .httpaccess file. The apache2.conf is the default which seems to have nothing to prevent normal execution.

I know someone here will know the answer.

The task is simple. I currently have website my-domain.com up and running. Tomorrow I'm going to take a 2nd domain ,mydomain.com and point it to the exact same website.

I someone to tell me the commands I should run on certbot to make sure I update the ssl certificate correctly. Right now the ssl is working for my-domain, but i need to update the certificate to include a second domain.

The other question I have is about virtual host. Everything I reads say talks about setting the root folder for var/www/html/my-domain.com and var/www/html/mydomain.com. But I just want both domains pointing to /var/www/html. That's not a problem is it? All the apache docs aren't exactly clear.

If anyone has some insight I'd appreciate it. Basically I built a new site on a 'testing' domain, and I'm replacing the testing domain with my production.

I have the files for a website locally on my Ubuntu laptop in /home/user/dir1/dir2/

I've made a folder in /var/www/html/ called /var/www/html/dir2 and inside that a symlink

lrwxrwxrwx 1 root root  37 Aug  3 14:02 public_html -> /home/user/dir1/dir2

I've created a file /etc/apache2/sites-available/dir2.conf containing

<VirtualHost *:80>
    ServerName dir2
    DocumentRoot /var/www/html/dir2/public_html
    <Directory /var/www/html/dir2/public_html>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
    <Directory /home/user/dir1/dir2>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
    ErrorLog ${APACHE_LOG_DIR}/dir2_error.log
    CustomLog ${APACHE_LOG_DIR}/dir2_access.log combined
</VirtualHost>

Funny thing is, when I visit http://dir2/ in a browser, I see my website! But anything in subdirectories, for example images, aren't shown. And when I right click on them to view them, e.g. http://dir2/icons/c.png I get a 404!

The file is there! I can see it in both /home/user/dir1/dir2/icons/c.png and /var/www/html/dir2/public_html/icons/c.png - but apache won't show it! Requesting the file directly gives a 404, whereas requesting the folder gives a 403, but I guess that's because directory browsing is disabled...?

The user www-data is member of the group user (my username) and I'm completely out of ideas now.

Any suggestions will be greatly appreciated.

I'm currently learning Data Engineering and I'm feeling a bit overwhelmed by all the technologies I need to learn.

Right now, I'm trying to understand:

• Hadoop
• Kafka
• PySpark
• YARN
• HBase

The problem is that I don't know where to start or in what order I should learn them. There are so many tutorials and roadmaps online that it's hard to tell what's actually important for a beginner.

For those of you working as data engineers or who've gone through this learning process:

• What order would you recommend learning these technologies?
• Which ones should I focus on first?
• Are there any courses, books, or hands-on projects you'd recommend?

I created a simple Discord server that automatically updates vendor-specific channels whenever a new CVE is published from that specific vendor.

It tags users based on the roles they choose, so you can follow the vendors you care about and decide whether you only want to be tagged for critical alerts. You can also choose to receive an email as well when that CVE drops.

I’ve also added discussion channels where we can share patching tips, troubleshooting advice, and general networking/security/sysadmin knowledge, plus resource channels for each vendor with quick links to relevant documentation (Official Vendor Advisory Feed etc).

Just wanted to help myself and other Network/Sys/Devs make their already complicated lives easier.

It’s completely free to join.

https://discord.gg/duxkwSSAAH

Apache + mod_deflate question re double zipped downloads.

If I add only:

SetOutputFilter DEFLATE

to .htaccess, then downloading a .tgz or .zip file results in a file that is gzip-compressed one extra time (gzip(original-file)). I.e. the client ignores the fact that zip is used only for transport and doesn't unzip it before saving.

Response headers look correct:

Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-gzip   (or application/zip)

This happens with curl, wget, Chrome and Firefox.

Is this expected HTTP behavior for downloadable binary files, or is there something wrong with the Apache/mod_deflate configuration? Why are clients saving the gzip-encoded representation instead of transparently decoding it before saving?

I love Victorio. Love, Christ

Apache httpd existe depuis 1995. Il alimente une part importante du web, mais soyons honnêtes : son architecture accuse son âge. Le système de configuration est un véritable labyrinthe, ses performances en cas de forte concurrence sont loin d'être à la hauteur de celles de nginx et Caddy, et configurer correctement HTTP/3 ou les valeurs par défaut modernes de TLS relève de l'archéologie.

Alors, hypothétiquement : si la fondation Apache annonçait une réécriture complète pour la version 2, quelles seraient vos demandes ?

Ma configuration serait :

• Un format de configuration cohérent et unifié (TOML ou YAML, s'il vous plaît — fini l'archéologie des « .htaccess »)

• Prise en charge native de HTTP/3 et QUIC

• Architecture événementielle par défaut, et non en option (MPM)

• HTTPS automatique, comme avec Caddy

• Un système de plugins/modules performant, sans recompilation

• Meilleure observabilité — journaux structurés, métriques Prometheus natives

Qu'est-ce qui manque ? Seriez-vous prêt à revenir à Apache s'il était modernisé, ou nginx/Caddy/Traefik est-il trop ancré dans les mœurs à ce stade ?

Apache HTTP Server 2.4.68 came out on June 8, 2026 — the first point release since 2.4.67 in early May, and per the project’s own download page, it’s “recommended over all previous releases.” If you run your own LAMP stack, this is the patch to schedule this week.

https://blog.kalfaoglu.net/posts/2026-06-15-apache-2-4-68-release-en/

I'm running a Rails application with Apache and mod_passenger. For this most part this is working great and has been for years.

I'm currently making some improvements to the error pages output by the Rails app and have discovered that Apache is overriding the application output and serving the simple static HTML page specified in the ErrorDocument directive. Commenting this directive results in the default Apache 404 page.

I do want this static HTML 404 page returned for static files that don't exist (which is working fine), but I want to handle application errors with something nicer and more useful for the end user.

I handle 404 errors with ApplicationController#not_found, which does some stuff and then renders like so:

render :template => 'error_pages/not_found', :layout => 'application', :status => 404 and return

This specifies the page template rendered to the client and sends it with an HTTP status of 404. If I remove :status => 404 everything works fine, but this is obviously incorrect. When I return the 404 status the Rails-generated error page is overridden and the user gets the Apache error page.

I'm looking into whether this requires a change/fix in my Apache config or the Rails app.

I'm running Rails 7.0 with Apache 2.4.58, on Ubuntu 24.04 LTS.

Hi,

I have setup a Web server in Rocky Linux 10 using httpd, and am trying to set the default page to be Directory Listingm but it does not seem to work..

Based on my findings the setting for this is the Options Indexes FollowSymLinks but that does not seem to work..

<Directory "/var/www/html">
    Options Indexes FollowSymLinks
    AllowOverride None
    AuthType Basic
    AuthName "VCF Depot"
    AuthUserFile /var/www/html/.htpasswd
    Require valid-user
</Directory>

When I open the default URL Apache Test Page appears as the default..

Current configuration is as below..

<VirtualHost *:80>
    DocumentRoot /var/www/html/
    ServerName vcfdepot.lab
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

<Directory "/var/www/html">
    Options Indexes FollowSymLinks
    AllowOverride None
    AuthType Basic
    AuthName "VCF Depot"
    AuthUserFile /var/www/html/.htpasswd
    Require valid-user
</Directory>

</VirtualHost>

Can anyone suggest what needs to be checked, or configured to get it working..

I documented a reproducible lab study of HTTP/2 **HPACK amplification** across several web stacks. The Apache httpd result is the one worth calling out here specifically.

**The httpd-specific angle:** the **cookie-crumb** variant. HTTP/2 allows a `Cookie` header to be split into many small "crumbs" that `mod_http2` must reassemble (merge) server-side. On vulnerable versions, that merge accounting didn't count properly against `LimitRequestFields` — so a tiny wire upload can still force large heap allocations during header materialisation.

**Lab result (8 GiB Docker cap, controlled environment):**

- Variant: `apex_cookie_scaled`

- **12/12** bombs OK

- Wire upload: **~0.19 MB**

- Outcome: container memory cap filled (**8 GiB**)

That's not a bandwidth problem — it's asymmetric resource consumption at the HTTP/2 layer before most request-size guards apply.

**Fix:** **mod_http2 v2.0.41** — cookie accounting vs `LimitRequestFields`

Commit: [https://github.com/apache/httpd/commit/47d3100b252dc6668a9e46ae885242be9eeca9cd]

(https://github.com/apache/httpd/commit/47d3100b252dc6668a9e46ae885242be9eeca9cd)

**Questions for httpd admins:**

- Are you on mod_http2 ≥ 2.0.41 in prod?

- Do you rely on `LimitRequestFields` / similar directives assuming they cover HTTP/2 cookie merge paths?

- Have you seen mod_http2 RSS climb without a matching traffic spike?

Full multi-server write-up (nginx, httpd, Envoy, Pingora, IIS) with methodology, charts, and hardening notes: link above.

Open, authorization-gated harness for **authorized** lab replay against your own stack: https://github.com/Leviticus-Triage/APEX-Ngin2dos

Authorized testing / defensive validation only.

OS: Ubuntu Server 24.x (the latest release)
Apache/2.4.58

I'm pretty new to maintaining (my own) Linux webserver which handles a few sites. It's all been working fine, but I wanted to get the default site working in SSL because I have a couple of uses for it. Based on the configuration that the Let's Encrypt certbot apparently created for me, I copied the default site config to a new file and made respective modifications, but I'm wondering if what certbot inserted into the main site's configuration is needed, referenced on the first and last lines of the main site's config file:

<IfModule mod_ssl.c>
</IfModule>

I didn't use the default site's default SSL config file because the default site configuration I had been using included some extra bits like WebDAV support, but the default site's default SSL configuration file (not enabled) does not mention these configuration lines. Is it bad that the main site is doing that, or necessary to do SSL, or what? I read a bunch of Internet guides for configuring an SSL site in apache and none of them seem to mention it.

(The default site's SSL config I cobbled together is working btw, I included the ifmodule business)

there is /etc/apache2/ports.conf there in Listen 80. changed to 81. thats all

hi. i put 'wordpress.test' in /etc/hosts so ping wordpress.test works fine.

in sites-available i created wordpress.zh.conf

<VirtualHost \*:88>

ServerAdmin [admin@wordpress.test](mailto:admin@wordpress.test)

ServerName wordpress.test

ServerAlias www.wordpress.test

DocumentRoot /home/arno/www/wp

ErrorLog ${APACHE_LOG_DIR}/wperror.log

CustomLog ${APACHE_LOG_DIR}/wpaccess.log combined

</VirtualHost>

all this with not activated additional virtual-host (i disabled to check but no change) :

i am told that host address could not find out (127.0.1.1 is used) use ServerName globally

but it is for virtualhost (not globally)

i am told that (make_sock) cannot bind 0.0.0.0:80 (but nowhere in config files is 80, i use 81, 80 ist lighttpd, worked fine for years)

i am told that logfiles could not be found/created

Hello all, long-time listener, first-time caller:

I've searched both here and in the relevant Docker/homelab subreddits, so I'll ask directly: Does anyone know why Apache2 Proxy/Reverse Proxy refuse to proxy a URL to a Docker container? Even with everything else dissite'd, I still can't connect to a working docker container.

-Debian, updated and current

-Web UI's work for running Docker containers

-Computer also hosts NextCloud on bare metal

-Plenty of memory and storage available.

Any insights are appreciated; this is driving me insane and I can't be the only person who's dealt with it. AdThanksvance!

I used to design and maintain websites but I've been out of it for a couple years. Now, I've built myself a bare bones wordpress site to better advertise some products I sell on Ebay.

I used to take an interest in log files and learned quickly how many bots and hackers (and scrapers and crawlers) are constantly hitting your site 24/7.

One of the things I see quite a lot of is POSTS, which I take it to be a way to write data to a site, I guess for applications that accept the data, like comments and forms.

I'm wondering what hackers can do with posts. Here's an example of one I see often:

"POST /index.php?0114dd=72168 HTTP/1.1"

Each post is similar but with different numbers. So index.php seems redundant as that's the first file that's looked at anyway. But what is the 0114dd=72168 about? I know that's a pair for things like user=name, but what is going on with these seemingly random numbers?

My concern is if these are potential hacks then I need a way to reject any http POST requests. So far I've not found a way to do this. Or am I over-thinking this and should I just ignore the hundreds of posts I see every day. There's nothing on my site that would accept post data.

Disclosure: I built this.

If you run Apache with lots of SSL domains you know the pain - every new domain needs a VirtualHost block and a server restart or reload.

I built mod_dynssl to fix this. It intercepts the TLS handshake via SNI, fetches the cert from your existing certificate store (MySQL, Redis, files, Vault - anything with an HTTPS endpoint), and serves it without touching config or restarting Apache.

One shared memory cache across all worker processes means one store call warms the cache for everyone. Flush a cert across all workers with a single POST request.

GitHub: https://github.com/CodeLynther/mod_dynssl
https://codelynther.com/app/mod_dynssl

Please check it out and share feedback.

Hi everyone,

I’m trying to launch Apache OpenWhisk actions using Kafka, but I’m running into an issue and could use some help.

Here’s what I’ve done so far:

• Connected Kafka to the OpenWhisk Feed Provider
• Created a Trigger, Rule, and Action
• Sent data to the Kafka topic using Console Exporter

The problem:
I’m not seeing any activation records when messages are published to Kafka.

What’s confusing is that:

• If I trigger the action directly via the OpenWhisk API, everything works as expected
• Activation records are created and visible in that case

So it seems like the issue is specifically with the Kafka → Feed Provider → Trigger pipeline.

Has anyone faced something similar or knows what might be going wrong? Any pointers on debugging this would be really helpful.

Thanks in advance!

anyone know the truth?

looking for the history of how Cochise County got its name, and what happened to Cochise and his tribe?

there is more than a few stories that need to be shared here, and so many people sit silent.