Apache · Configuration and operations
What are Apache best practices for production?
Short answer
Treat Apache configuration as code: version it, validate with configtest, reload gracefully, keep modules minimal, enforce TLS and least privilege, and monitor logs, latency and worker saturation. Test changes before rollout.
Production Apache is mostly about repeatability and observability. A server that was hand-edited over years is hard to rebuild, audit or roll back. Configuration should live in version control, be rendered deterministically and be validated in CI or at startup.
apachectl configtest
systemctl reload apache2
curl -fsS https://example.com/health
curl -sI https://example.com/ | grep -Ei 'strict-transport|content-security|cache-control'
journalctl -u apache2 --since "10 min ago" --no-pagerThe baseline I would defend in review
- Separate virtual hosts with explicit ServerName and a harmless default host
- AllowOverride None and configuration in version-controlled includes
- Minimal modules, no sample content and no directory listing
- TLS 1.2 and 1.3, HSTS after verification, and a tested renewal reload
- Security headers owned by one layer, with no duplicates
- Request body limits, timeouts and protected administrative handlers
- Access and error logs shipped centrally, with request IDs for correlation
- MPM and keep-alive settings sized from measured memory and traffic
- Health checks and a graceful reload path exercised regularly
- Patching cadence for Apache and every loaded module
Roll out configuration in stages: validate syntax, reload one instance, check health and error rate, then continue. Keep a known-good configuration and a documented rollback. A reload that passes configtest can still change routing, so verify real requests rather than only the process status.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1How do you roll out an Apache configuration change safely?
- 2Which security headers would you standardize?
- 3What would you monitor beyond CPU and memory?
- 4How do you handle configuration drift across servers?
Say it in the interview
I treat Apache config as code: versioned, reviewed, validated and rolled out one instance at a time. The baseline is minimal modules, explicit vhosts, AllowOverride None, modern TLS and security headers owned by one layer. I monitor errors, latency and worker saturation, and I exercise health checks and graceful reloads before I need them. Rollback is planned, not improvised.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Apache mock interview and get scored feedback on depth, clarity and confidence.