Apache HTTP Server

Apache HTTP Server
The Apache Software Foundation · Apache License 2.0 · source
Name	Apache HTTP Server
Caption	The Apache HTTP Server logo, featuring a stylized feather.
Developer	Robert McCool, Apache Software Foundation
Released	18 April 1995
Latest release version	2.4.58
Latest release date	19 October 2023
Programming language	C, XML
Operating system	Cross-platform
Genre	Web server
License	Apache License 2.0
Website	httpd.apache.org

Apache HTTP Server. Often referred to simply as Apache, it is a free and open-source cross-platform web server software developed and maintained by an open community of developers under the auspices of the Apache Software Foundation. Released in 1995, it played a pivotal role in the initial growth of the World Wide Web and has been the most popular web server on the Internet since April 1996. The server is highly customizable through a modular architecture and supports a wide range of features, making it a cornerstone for hosting dynamic websites and applications across diverse operating systems like Unix, Linux, Microsoft Windows, and macOS.

History

The project began in early 1995 as a series of patches to the then-dominant NCSA HTTPd server, created by Robert McCool. This led to the name "A PAtCHy" server, which was later formalized as Apache. Following McCool's departure from the National Center for Supercomputing Applications, a group of webmasters, known as the Apache Group, formed to coordinate development. The release of Apache 1.0 in December 1995 quickly gained market share. In 1999, the developers incorporated to form the nonprofit Apache Software Foundation, which now oversees hundreds of projects. Key milestones include the major redesign for the 2.x series, which introduced a more robust Multi-Processing Module architecture, and its enduring competition with servers like IIS and nginx.

Features

Apache provides a comprehensive suite of features essential for modern web hosting. It supports a variety of authentication modules, including integration with LDAP and SQL databases. The server offers sophisticated content negotiation, virtual hosting for serving multiple websites from a single instance, and extensive logging capabilities. It natively supports the Server Side Includes technology and can execute CGI scripts. Furthermore, it is designed to work seamlessly with popular programming languages and frameworks through modules like mod_php for PHP, mod_wsgi for Python, and mod_perl for Perl, facilitating the deployment of dynamic applications.

Architecture

The core architecture is based on a modular design, where a relatively small core server is extended with dynamically loadable modules. This design is complemented by the Multi-Processing Module system, which defines how the server binds to network ports, accepts requests, and dispatches them to child processes or threads. Common MPMs include the prefork model for stability with non-thread-safe libraries, the worker model for a hybrid of processes and threads, and the event MPM optimized for keeping many connections open. This structure allows Apache to be optimized for different operating systems and workloads, balancing between the Unix process model and the threading models of Microsoft Windows.

Configuration

Configuration is primarily managed through plain-text files, most notably the central `httpd.conf` file, though settings can be distributed across auxiliary files. The configuration uses a directive-based syntax, where administrators set parameters like `DocumentRoot` and `DirectoryIndex`. A powerful feature is the use of `.htaccess` files, which allow for decentralized configuration management by placing directives within the content directories themselves, a method particularly associated with shared hosting providers like cPanel-based environments. The `apachectl` or `apache2ctl` command-line tool is used for controlling the server process.

Security

Security is a major focus, with the project maintaining a dedicated security team and issuing frequent advisories. Key security features include support for Transport Layer Security and the now-deprecated Secure Sockets Layer protocols via mod_ssl, robust access control based on IP address, hostname, or user credentials, and the ability to run within a chroot jail or with reduced operating system privileges. Modules like mod_security provide an application-level firewall. The server's security history includes responses to significant vulnerabilities like the 2011 CVE-2011-3192 denial-of-service issue.

Performance

While traditionally praised for its flexibility over raw speed, significant performance improvements have been made, especially with the event MPM and enhanced caching mechanisms. Performance is heavily influenced by the chosen MPM and configured modules; for example, serving static files is highly efficient, while dynamic content processing depends on the backend interpreter. Caching modules like mod_cache can dramatically improve response times. Its performance is often compared to that of nginx and Lighttpd, particularly in high-concurrency scenarios, leading to common deployment patterns where Apache handles dynamic application logic behind a reverse proxy.

Development and community

Development is a collaborative, consensus-driven process managed under the Apache Software Foundation's meritocratic model, known as "The Apache Way." Contributors, from individuals to corporations like IBM and Google, submit patches and vote on releases through mailing lists. The project is governed by a Project Management Committee of volunteers. Its source code is maintained in a Subversion repository, with discussions and decisions transparently archived. This open community model has been instrumental in its longevity, fostering innovation through related projects at the ASF such as the Apache Tomcat servlet container.