How to Setup Apache Reverse Proxy

An Apache reverse proxy is a server setup that takes incoming web traffic and sends it to the right backend application. Running Apache version 2.4 or newer gives you built-in modules that handle this traffic routing directly.

This setup helps protect your web apps and spreads visitor traffic across multiple servers so your site stays fast. It works well for programs like Node.js or Python that lack their own built-in web servers.

This guide covers the basic proxy setup, PHP-FPM, HTTPS, WebSocket traffic, forwarded headers and a simple load balancer. You need an Apache 2.4 server and an account with root or sudo rights. The commands below use the Debian and Ubuntu tools (a2enmod, the apache2 service). On RHEL, Fedora and similar systems the service is called httpd, and modules are loaded with LoadModule lines in the configuration instead.

How to use Apache as a reverse proxy server

Apache reverse proxy setup requires turning on the proxy and proxy_http modules in your server configuration files. These modules let Apache act as a gateway that passes incoming visitor requests to a back-end server and sends the response back to the user, hiding your internal network details.

Do this before you edit any virtual host. If the modules are not loaded, Apache stops with an “Invalid command” error as soon as it reads a proxy directive.

Here is how to enable these Apache modules:

1. Open a terminal on the server and make sure you can use sudo or are signed in as root.
2. Enable the two core modules with sudo a2enmod proxy proxy_http. The command prints a line for each module it enables and tells you to restart Apache.
3. Restart Apache with sudo systemctl restart apache2. A restart is required the first time you load a new module. A plain reload does not load modules.

The modules you enable later in this guide follow the same pattern: run a2enmod, then restart Apache once. To undo it, run sudo a2dismod proxy_http (or the module you want to remove) and restart again.

The ProxyPass directive in the Apache web server configuration identifies the backend server that will receive incoming website requests. This configuration line makes the Apache proxy server act as a middleman, forwarding traffic to the correct server. ProxyPass is available in all Apache 2.4 releases; use the latest 2.4.x release.

ProxyRequests controls forward proxying, which is a different job from reverse proxying. Setting it to On turns your server into an open proxy that anyone on the internet can use to relay traffic, and attackers do abuse these. A reverse proxy needs only ProxyPass and its related directives. Apache’s default is Off, so leave it alone unless you know you need forward proxying.

<VirtualHost *:*>
    ServerName example.com
    ProxyPreserveHost On

    # Servers to proxy the connection, or;

    ProxyPass / http://127.0.0.1:8080/
    ProxyPassReverse / http://127.0.0.1:8080/

</VirtualHost>

This configuration tells Apache to send all requests for the example.com domain’s root directory (/) to the server at http://127.0.0.1:8080.

Before you apply a change, test the syntax:

1. Run sudo apachectl configtest.
2. Look for Syntax OK. If you see an error, it names the file and line to fix. Do not reload until the test passes, because a bad configuration can stop Apache from restarting.
3. Apply the change with sudo systemctl reload apache2. A reload is enough for edits to a virtual host. You only need a full restart after enabling a module.

For example, if a client requests http://example.com/, Apache forwards that request to the backend server defined on the ProxyPass and ProxyPassReverse lines: http://127.0.0.1:8080.

To check it, request the site from a browser or with curl. You should see the backend application’s response, not the default Apache page. If you get a 503 error, the backend is probably not running or is not listening on the address in your configuration.

Apache offers advanced settings for proxy servers beyond this basic configuration. This example illustrates how Apache proxy servers function.

Three common additions are HTTPS, WebSocket support and load balancing. Each needs extra modules, so enable them first.

• HTTPSEnable mod_ssl with sudo a2enmod ssl. The usual way to get a free certificate is Let’s Encrypt with certbot, and its Apache plugin can create the HTTPS virtual host for you. Because the backend now sees plain HTTP from Apache, tell it the visitor used HTTPS. Enable mod_headers with sudo a2enmod headers, then add RequestHeader set X-Forwarded-Proto "https" inside the HTTPS virtual host.
• WebSocketsChat apps, dashboards and many Node.js frameworks use WebSockets. Enable the module with sudo a2enmod proxy_wstunnel. Then proxy the WebSocket path with a ws:// address, for example ProxyPass "/ws/" "ws://127.0.0.1:3000/ws/".
• Load balancingTo spread traffic over several backends, enable sudo a2enmod proxy_balancer lbmethod_byrequests. Define a balancer:// group with one BalancerMember line per backend server, then point ProxyPass at the group.

As always, run apachectl configtest and restart Apache after enabling modules.

Apache also handles requests for non-HTTP servers, such as:

• proxy_fcgi – reverse proxy to a FastCGI server.
• proxy_uwsgi – reverse proxy to a uwsgi server.
• proxy_scgi – reverse proxy to an SCGI server.

Apache often proxies requests to non-HTTP hosts using PHP-FPM. This method represents the standard way Apache serves PHP scripts.

Each protocol has its own proxy module. The FastCGI scheme relies on proxy_fcgi, and the other schemes in the list need their matching modules loaded the same way.

<VirtualHost *:*>
    ServerName example.com
    ProxyPreserveHost On

    # Servers to proxy the connection, or;

    <FilesMatch .php$>
        # 2.4.10+ can proxy to unix socket
         SetHandler "proxy:unix:/run/php/php7.4-fpm.sock|fcgi://localhost"
    </FilesMatch>

</VirtualHost>

Enabling a few modules allows apache2 to work with PHP-FPM:

1. Enable the FastCGI proxy module and setenvif with sudo a2enmod proxy_fcgi setenvif.
2. Restart Apache with sudo systemctl restart apache2.

You need root or sudo rights for both commands. The proxy_fcgi module also depends on proxy, which you enabled earlier. PHP-FPM itself must be installed and running, or Apache returns a 503 error for PHP pages.

Configuring an Apache reverse proxy involves setting up options that dictate how the server handles incoming requests and forwards them. This setup ensures Apache knows precisely where to send traffic and preserves critical details, such as the original website address.

The next example uses directives from two more modules that are not loaded by default. Enable them first, or the configuration test fails with an “Invalid command” error or the directives do nothing:

• RemoteIPHeader belongs to mod_remoteip. Enable it with sudo a2enmod remoteip. It lets Apache read the real client address from a header such as X-Forwarded-For. This matters when another proxy or load balancer sits in front of Apache. Only trust that header from proxies you control.
• CacheStaleOnError belongs to mod_cache. Enable it with sudo a2enmod cache. mod_cache also needs a storage module, such as cache_disk, before it can store anything.

Restart Apache after enabling them, and run apachectl configtest before you reload the new configuration.

<VirtualHost *:*>
    ServerName example.com

    UseCanonicalName on
    ProxyPreserveHost on
    CacheStaleOnError on
    RemoteIPHeader X-Forwarded-For
    ProxyRequests Off

    ProxyPass / http://127.0.0.1:8080/
    ProxyPassReverse / http://127.0.0.1:8080/

</VirtualHost>

Consult the site for more options to use in your environment.

Setting up Apache as a reverse proxy allows you to efficiently manage client requests and backend servers.

Conclusion:

• Setting up Apache as a reverse proxy allows you to efficiently manage client requests and backend servers.
• Apache provides extensive modules that enhance its functionality for reverse proxy operations.
• Simple configurations can effectively route requests to desired backend applications, such as Node.js, Python, and PHP-FPM.
• Advanced configurations are available for handling various types of requests beyond HTTP.
• Understanding the fundamental reverse proxy concepts can help optimize web application performance and reliability.
• For further customization and options, refer to the official Apache documentation on reverse proxy settings.