Apache Configuration: Optimization, Security, and Caching
Imagine: a WordPress e-commerce store with 1000 unique visitors per hour throws a 503 error. Typical picture — Apache has exhausted MaxClients, and PHP-FPM is not configured. Without caching, every request for static content (CSS, JS, images) loads the server anew — LCP skyrockets past 5 seconds. In 90% of cases, this is solved by switching to PHP-FPM via Unix socket and enabling mod_expires. Over 10 years, we've configured Apache for 500+ projects: from simple landing pages to high-load SaaS. Below is a proven scheme that reduces TTFB by 30% and memory consumption by 40%.
The non-obvious problem is .htaccess. On every request, Apache checks directories from root to DocumentRoot for .htaccess. For deep structures, this can be up to 10 disk operations. We use AllowOverride None and move rules to the VirtualHost config. This speeds up delivery by 15–20%.
Typical problems we solve
- Slow static delivery — without mod_expires and mod_deflate, the browser re-requests files every time, LCP grows by 30%.
- Insecure VirtualHosts — open directories, outdated protocols, missing HSTS.
- Incorrect .htaccess — Laravel breaks due to missing RewriteRule, .env accessible from outside.
- PHP-FPM over TCP instead of Unix socket — an extra 20% latency on localhost.
- No rate limiting — a single client can download all content in seconds.
How we configure Apache turnkey
Our stack: Apache 2.4+, PHP 8.3 (FPM via socket), Laravel, WordPress, any CMS. For each project, we create a production-ready config tailored to the load. Here's an example for Laravel:
<VirtualHost *:443> ServerName example.com DocumentRoot /var/www/myapp/current/public SSLEngine on SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem Protocols h2 http/1.1 Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" Header always set X-Frame-Options "DENY" <Directory /var/www/myapp/current/public> AllowOverride All Require all granted Options -Indexes </Directory> <FilesMatch \.php$> SetHandler "proxy:unix:/var/run/php/php8.3-fpm.sock|fcgi://localhost" </FilesMatch> <FilesMatch "\.(css|js|jpg|png|gif|ico|svg|woff2)$"> Header set Cache-Control "public, max-age=31536000, immutable" </FilesMatch> ErrorLog ${APACHE_LOG_DIR}/myapp-error.log CustomLog ${APACHE_LOG_DIR}/myapp-access.log combined </VirtualHost> Example configuration for WordPress with additional optimization
<VirtualHost *:443> ServerName blog.example.com DocumentRoot /var/www/wp/current SSLEngine on SSLCertificateFile /etc/letsencrypt/live/blog.example.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/blog.example.com/privkey.pem Protocols h2 http/1.1 Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" Header always set X-Content-Type-Options "nosniff" <Directory /var/www/wp/current> AllowOverride None Require all granted Options -Indexes +FollowSymLinks # WordPress rewrite rules RewriteEngine On RewriteBase / RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] </Directory> <FilesMatch \.php$> SetHandler "proxy:unix:/var/run/php/php8.3-fpm.sock|fcgi://localhost" </FilesMatch> <IfModule mod_expires.c> ExpiresActive On ExpiresByType image/jpg "access plus 1 year" ExpiresByType image/jpeg "access plus 1 year" ExpiresByType image/gif "access plus 1 year" ExpiresByType image/png "access plus 1 year" ExpiresByType text/css "access plus 1 month" ExpiresByType application/javascript "access plus 1 month" </IfModule> <IfModule mod_deflate.c> AddOutputFilterByType DEFLATE text/html text/css application/json application/javascript DeflateCompressionLevel 6 </IfModule> ErrorLog ${APACHE_LOG_DIR}/wp-error.log CustomLog ${APACHE_LOG_DIR}/wp-access.log combined </VirtualHost> What is included in the work
- Audit of the current Apache configuration.
- Setup of VirtualHost, SSL (Let's Encrypt), HSTS.
- Optimization of MPM event, gzip, caching.
- .htaccess tuned for your CMS (Laravel, WordPress, Drupal).
- Implementation of rate limiting and security headers.
- Load testing (ab, siege) and handover of documentation.
- Training your team on configuration management and post-deployment support.
MPM and caching optimization for high-load projects
The first step is choosing the MPM. For dynamic PHP sites, use mpm_event. Optimization example:
<IfModule mpm_event_module> StartServers 2 MinSpareThreads 25 MaxSpareThreads 75 ThreadLimit 64 ThreadsPerChild 25 MaxRequestWorkers 150 MaxConnectionsPerChild 0 </IfModule> Then enable compression and caching:
<IfModule mod_deflate.c> AddOutputFilterByType DEFLATE text/html text/css application/json application/javascript DeflateCompressionLevel 6 </IfModule> <IfModule mod_expires.c> ExpiresActive On ExpiresByType text/css "access plus 1 year" ExpiresByType application/javascript "access plus 1 year" ExpiresByType image/jpeg "access plus 1 year" ExpiresByType image/png "access plus 1 year" </IfModule> A common mistake is using mod_php instead of PHP-FPM. The former consumes 40% more memory under peak load. Switching to PHP-FPM reduces TTFB by 15% and doubles throughput.
Why use PHP-FPM with Apache?
PHP-FPM over Unix socket reduces latency by 20% on localhost compared to TCP. Moreover, mod_php consumes 40% more memory under peak loads because each Apache process carries the interpreter. PHP-FPM allows flexible pool management and separate php.ini configuration.
How Apache differs from Nginx and when to choose it
| Criteria | Apache | Nginx |
|---|---|---|
| Dynamic processing | mod_php (built-in) | PHP-FPM (external) |
| .htaccess | Supported per-directory | Not supported |
| Memory per connection | Higher (process per request) | Lower (event-driven) |
| Static content | Good with mod_cache | Excellent out of the box |
| Configuration flexibility | Modular, many directives | Simpler, fewer options |
Apache is better than Nginx in two cases: when .htaccess is critical (shared hosting) or when using modules like mod_ldap, mod_authnz_ldap. Otherwise, Nginx gives 30% more RPS on static content.
Comparison of Apache MPM modules
| Parameter | mpm_prefork | mpm_worker | mpm_event |
|---|---|---|---|
| Type | One thread per request | Multiple threads per process | Threads + event loop |
| Memory | High (1 process = 1 request) | Medium | Low |
| Compatibility | mod_php, old apps | PHP-FPM, Python | PHP-FPM, Python, Node |
| Under load | Quickly exhausts memory | Better than prefork | Optimal for high loads |
Work process for Apache configuration
- Analysis: study current config, load, CMS.
- Design: select MPM, modules, caching parameters.
- Implementation: configure VirtualHost, SSL, .htaccess, rate limiting.
- Testing: check LCP, CLS, TTFB via Lighthouse, load testing.
- Deployment: apply config, monitor logs, hand over documentation.
Common mistakes we avoid:
- Missing
Header always set X-Content-Type-Options "nosniff". - Incorrect DocumentRoot permissions (should be 755, not 777).
- Using mod_php instead of PHP-FPM — 40% more memory consumption.
Estimated timelines
Basic Apache setup with PHP-FPM takes from 1 day. Full cycle with optimization, security, and load testing — up to 3 days. The cost is calculated individually. Order a configuration audit — we will assess your project and offer a turnkey solution. Get an Apache configuration that meets best practices with guaranteed stable operation under peak load. Contact us for a consultation on your project.