Apache · Configuration and operations
How do you enable and tune compression in Apache?
Short answer
Use mod_deflate or mod_brotli to compress text-based responses, scope it to compressible content types and avoid double-compressing images. Add Vary: Accept-Encoding when responses differ by encoding.
Compression reduces bytes on the wire but costs CPU. Text formats such as HTML, CSS, JavaScript, JSON and SVG benefit. Images, video, fonts and archives are already compressed and usually get larger or waste CPU. Compression also interacts with caching, because a cache must key on the accepted encoding.
LoadModule deflate_module modules/mod_deflate.so
LoadModule brotli_module modules/mod_brotli.so
<IfModule mod_deflate_module>
AddOutputFilterByType DEFLATE text/html text/plain text/css
AddOutputFilterByType DEFLATE application/javascript application/json
AddOutputFilterByType DEFLATE image/svg+xml
DeflateCompressionLevel 6
</IfModule>
<IfModule mod_brotli_module>
AddOutputFilterByType BROTLI_COMPRESS text/html text/css
AddOutputFilterByType BROTLI_COMPRESS application/javascript application/json
</IfModule>
Header append Vary Accept-EncodingTrade-offs
- Higher compression levels cost more CPU for diminishing size gains
- Brotli often beats gzip for static text, but dynamic Brotli can be expensive
- Do not compress secrets together with attacker-controlled input without considering BREACH
- Compressing at the CDN or reverse proxy can be cheaper than at every Apache worker
- Precompressed static files avoid per-request compression work
Use Vary: Accept-Encoding so caches do not serve a gzip response to a client that did not ask for it. Check with curl -H 'Accept-Encoding: gzip' -I and confirm both Content-Encoding and Content-Length or chunked transfer.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1Which content types should you compress?
- 2Why is Vary: Accept-Encoding important?
- 3When would you compress at the CDN instead of Apache?
- 4What is the BREACH concern?
Say it in the interview
I enable mod_deflate or mod_brotli only for text-based types and skip images and archives. I set Vary Accept-Encoding so caches stay correct, and I keep levels moderate because CPU cost rises faster than savings. For high traffic I often move compression to a CDN or serve precompressed files, and I check the actual response headers with curl.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Apache mock interview and get scored feedback on depth, clarity and confidence.