What are common Apache configuration mistakes?

Apache is flexible enough to let a bad configuration work in testing and fail under load or attack. The recurring problems tend to be about scope, ordering and defaults rather than obscure directives.

• AllowOverride All on every directory, paying per-request parsing and exposing directives
• No explicit default virtual host, so unknown Host headers reach a real site
• ProxyPass without a matching ProxyPassReverse, leaking internal redirects
• Rewrite rules that match their own output and loop until a 500
• Leaving ProxyRequests On and creating an open forward proxy
• Mixing Apache 2.2 Order/Allow/Deny with 2.4 Require without understanding precedence
• Reloading without configtest and discovering a typo during a restart
• Loading many unused modules and increasing patch surface
• Serving .git, backups or environment files from the document root
• Setting timeouts and worker counts by copying a blog post instead of measuring

<VirtualHost *:443>
  ServerName example.com
  DocumentRoot /var/www/example/public
  ProxyPass /api http://127.0.0.1:3000/api
  ProxyPassReverse /api http://127.0.0.1:3000/api

  <Directory "/var/www/example/public">
    Options -Indexes +FollowSymLinks
    AllowOverride None
    Require all granted
  </Directory>
</VirtualHost>

Another frequent issue is assuming that a directive in a Location section and the same directive in a Directory section apply independently. They merge, and Location is processed later, so the effective value may not be what you expect. Use apachectl -S and targeted trace logging to see the real mapping.