Apache Performance Optimization: Compression, Caching, and Security

Optimization Overview

Optimizing an Apache HTTP Server deployment involves several key areas: enabling content compression, configuring browser caching, selecting appropriate worker models, and implementing security hardening measures. This guide covers practical configuration steps for each of these aspects.

Multi-Processing Module Selection

Apache operates in three distinct worker modes, each suited for different deployment scenarios.

Prefork Mode (Default)

Prefork is a non-threaded, pre-forking model that creates child processes to handle requests. This approach provides excellent stability—individual process failures do not affect other requests. The server starts with a predetermined number of pre-spawned child processes, reducing latency when handling incoming connections. Memory consumption tends to be higher since each process maintains its own memory space, but the isolation benefits make it suitable for environments requiring maximum reliability or when running non-thread-safe modules.

Worker Mode

Worker mode employs multiple child processes, each containing multiple threads. Since threads share memory within their parent process, resource utilization is more efficient than prefork. This configuration handles high-traffic workloads effectively but offers less isolation—thread or process failures can impact other threads within the same process. Worker mode works well when running thread-safe code and serving content that benefits from connecsion keep-alive.

Event Mode

Event mode was developed specifically to address keep-alive connection management issues. Under keep-alive, threads remain occupied waiting for additional requests even during idle periods, only releasing after timeout. Event mode introduces dedicated listener threads to manage keep-alive connections, allowing request handler threads to return to the pool immediately after completing transactions. This dramatically improves concurrency handling. Note that event mode has limitations with HTTPS connections.

Comparative Analysis

Prefork spawns multiple single-threaded processes where each maintains one connection at a time. Worker mode creates multi-threaded processes where each thread handles one connection simultaneously, optimizing for throughput. Performance benchmarks typically show prefork slightly faster per-request, but worker mode demonstrates superior efficiency under high load with lower memory footprint.

Configuring Gzip Compression

Enabling compression reduces network payload size, accelertaes page delivery, conserves bandwidth, and improves search engine crawl efficiency. Apache implements compression through specialized modules.

Compression Modules

mod_deflate (Apache 2.x native): Offers faster compression with acceptable ratios and lower CPU overhead. This module is built into Apache 2.x by default and provides the best balance of speed and compression efficiency.

mod_gzip (Apache 1.x): Original developed as a third-party module for Apache 1.x, it produces slightly higher compression ratios but demands more CPU cycles. Apache 2.x development replaced it with the native mod_deflate module.

Implementation Steps

Step 1: Enable the mod_deflate module during compilation

./configure --prefix=/usr/local/apache2 --enable-so --enable-rewrite \
  --enable-charset-lite --enable-cgi --enable-deflate

Step 2: Install required dependencies

yum -y install gcc gcc-* make
yum -y install apr-util-devel pcre-devel zlib-devel

Step 3: Build and install Apache

tar zxf httpd-2.4.25.tar.gz -C /usr/src
cd /usr/src/httpd-2.4.25/
./configure --prefix=/usr/local/httpd --enable-so --enable-rewrite \
  --enable-charset-lite --enable-cgi --enable-deflate
make && make install
ln -s /usr/local/httpd/bin/* /usr/local/bin

Step 4: Configure systemd service

cat > /lib/systemd/system/httpd.service << 'EOF'
[Unit]
Description=The Apache HTTP Server
After=network.target

[Service]
Type=forking
PIDFile=/usr/local/httpd/logs/httpd.pid
ExecStart=/usr/local/bin/apachectl $OPTIONS
ExecReload=/bin/kill -HUP $MAINPID

[Install]
WantedBy=multi-user.target
EOF

systemctl enable httpd.service
systemctl start httpd.service

Step 5: Add compression directives to httpd.conf

vi /usr/local/httpd/conf/httpd.conf

Uncomment line 106 to load the module, then append these compression settings:

<IfModule mod_deflate.c>
    # Compression level (0-9, 6 is optimal balance)
    DeflateCompressionLevel 6
    
    # Apply DEFLATE filter to output
    SetOutputFilter DEFLATE
    
    # MIME types to compress
    AddOutputFilterByType DEFLATE text/html text/plain text/xml
    AddOutputFilterByType DEFLATE text/css text/javascript
    AddOutputFilterByType DEFLATE application/x-javascript
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/json
    
    # Exclude binary files from compression
    SetEnvIfNoCase Request_URI .(?:gif|jpe?g|png)$ no-gzip dont-vary
    SetEnvIfNoCase Request_URI .(?:exe|t?gz|zip|bz2|sit|rar)$ no-gzip dont-vary
    SetEnvIfNoCase Request_URI .(?:pdf|mov|avi|mp3|mp4|rm)$ no-gzip dont-vary
    
    # Additional compression targets
    AddOutputFilterByType DEFLATE text/*
    AddOutputFilterByType DEFLATE application/ms* application/vnd* application/postscript
    AddOutputFilterByType DEFLATE application/x-httpd-php application/x-httpd-fastphp
</IfModule>

Step 6: Restart Apache and verify

systemctl restart httpd
apachectl -t -D DUMP_MODULES | grep deflate

Test compression by browsing the site, opening Developer Tools (F12), and inspecting response headers for Content-Encoding: gzip.

Configuring Browser Caching

The mod_expires module enables automatic cache header generation, reducing redundant client requests and bandwidth consumption.

Step 1: Enable mod_expires during Apache compilation

./configure --prefix=/usr/local/httpd --enable-so --enable-deflate --enable-expires

Step 2: Configure expiration rules

vi /usr/local/httpd/conf/httpd.conf

Uncomment approximately line 113 to load mod_expires, then add at the file end:

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault "access plus 60 seconds"
</IfModule>

Step 3: Verification

Create a test HTML file, deploy it, then use browser Developer Tools to inspect response headers. Presence of Expires and Cache-Control headers confirms caching is operational.

Security Hardening

Hiding Server Version Information

Exposing Apache version details provides reconnaissance information to potential attackers. The httpd-default.conf file controls version disclosure:

vi /usr/local/httpd/conf/extra/httpd-default.conf

Locate and modify version exposure settings, then ensure the following directive is uncommented in the main httpd.conf:

Include conf/extra/httpd-default.conf

Validate configuration syntax before restarting:

apachectl -t

Hotlink Protection

Preventing unauthorized resource linking preserves bandwidth and server resources. This example demonstrates referrer-based blocking using mod_rewrite.

Test Environment Setup:

Three systems are involved: two Apache servers and one client browser. Server01 (192.168.27.131) hosts images, Server02 (192.168.27.129) contains linking pages, and the client accesses content for testing.

Step 1: Configure DNS resolution on all systems

# /etc/hosts on Server01 and Server02
192.168.27.131 www.resource-server.com
192.168.27.129 www.linked-site.com

# /etc/hosts on client browser
192.168.27.131 www.resource-server.com
192.168.27.129 www.linked-site.com

Step 2: Upload test resources to Server01

Place image files in Server01's document root directory.

Step 3: Create linking page on Server02

<html>
<body>
<h1>Welcome</h1>
<img src="http://www.resource-server.com/image.jpg"/>
</body>
</html>

Step 4: Implement hotlink protection on Server01

Enable mod_rewrite (uncomment line 159 in httpd.conf), then modify the directory section (around line 246) to allow .htaccess override:

<Directory "/usr/local/httpd/htdocs">
    Options Indexes FollowSymLinks
    AllowOverride All
    Require all granted
</Directory>

Create or edit .htaccess in the document root:

RewriteEngine On

# Allow direct access and valid referrers
RewriteCond %{HTTP_REFERER} !^http://resource-server\.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://resource-server\.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www\.resource-server\.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www\.resource-server\.com/$ [NC]

# Redirect blocked requests to error image
RewriteRule .*\.(gif|jpg|swf)$ http://www.resource-server.com/forbidden.png

Step 5: Restart services and test

Restart Apache on Server01, then access the linking page from the client browser. Requests from unauthorized referrers will display the error image instead of the requested content.

Tags: apache httpd gzip mod_deflate mod_expires

Posted on Sat, 01 Aug 2026 16:09:44 +0000 by kef

Freaks City