iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To set up Apache as a reverse proxy, install Apache, load the proxy modules required by your backend, create a virtual host for the public hostname, and pair ProxyPass with ProxyPassReverse. Keep ProxyRequests Off, point the mapping at a fixed backend address, validate the configuration, reload Apache, and test through the public hostname.
For example, a request for https://app.example.com/ can be accepted by Apache and forwarded to an application listening on 127.0.0.1:3000. Visitors see only Apache; the application server remains behind the gateway. The same pattern can be narrowed to a subpath, expanded to WebSocket traffic, or replaced with a balancer group when you need multiple backends.
What does Apache do as a reverse proxy?
Apache HTTP Server acts as a gateway between clients and one or more application servers. A browser sends an ordinary request to Apache, Apache sends a corresponding request to the configured backend, and Apache returns the backend response to the browser. To the client, the gateway looks like the web server; the backend can remain on a loopback address or a private network.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
This arrangement gives you one public entry point for TLS termination, access control, logging, URL routing, and application isolation. It also means Apache must be able to reach every backend it serves, and applications must generate redirects, cookies, and URLs that make sense in the public URL space.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Apache’s documentation describes a reverse proxy as appearing to the client like an ordinary web server while the gateway retrieves content from an internal server. That distinction matters operationally: clients should address the public hostname, while the backend destination is an implementation detail. If users can reach the backend directly, they may bypass the controls, certificates, logs, and routing rules you intended Apache to provide.
What do I need before configuring Apache?
Prepare the public hostname, the backend protocol and address, and the URL path Apache should expose. The backend destination should be explicit and fixed rather than derived from untrusted request data.
Prerequisites
- An installed Apache HTTP Server package from your operating system.
- A running application with a known listening address and port, such as
http://127.0.0.1:3000/. - DNS for the public hostname pointing to the Apache host.
- The proxy modules required by your deployment. At minimum, load
mod_proxyand support for the backend scheme, commonly the HTTP proxy module. Modules may be compiled into Apache or loaded dynamically. - Administrative access to edit the virtual-host configuration, run the platform’s configuration test, reload Apache, and inspect its logs.
Module names, configuration-file locations, service names, and test commands differ between distributions. Use the package and service conventions of the operating system running Apache rather than copying a path from another distribution.
Write down the intended URL space before editing the configuration. Decide whether the application is published at /, at a prefix such as /app/, or on a separate hostname. Also record whether the backend speaks HTTP, uses another supported scheme, or listens through a Unix socket. These details determine which proxy support is needed and make later troubleshooting much faster.
How do I configure a basic Apache reverse proxy?
Use a virtual host with matching ProxyPass and ProxyPassReverse directives. The first forwards requests; the second rewrites redirect-related response headers so the backend does not expose its private address.
- Install Apache. Use your operating system’s package method, then confirm that the service can start normally.
- Load the proxy support. Ensure
mod_proxyand the HTTP scheme support used by the backend are enabled. If your application uses another protocol, load the corresponding support documented for your installed Apache version. - Create a virtual host. Add a host for the public name. This example publishes the application at the site root:
<VirtualHost *:80>
ServerName app.example.com
ProxyPass / http://127.0.0.1:3000/
ProxyPassReverse / http://127.0.0.1:3000/
</VirtualHost>- Keep reverse and forward proxying separate. Set
ProxyRequests Offin the server or virtual-host configuration.ProxyRequestsenables forward-proxy mode, in which Apache fetches arbitrary destinations for clients; that is not required for a reverse proxy. - Check the mapping. Confirm that the backend address, port, protocol, and path are correct, and that the Apache process can connect to them from the server itself.
- Validate and reload. Run the configuration-test command supplied by your platform (a common command is
apachectl configtest), correct any syntax errors, and reload the Apache service. The exact command and service name vary by distribution. - Test through the public name. Request the public hostname, then check the Apache access and error logs, the application’s logs, redirects, cookies, and generated URLs.
Keep the backend bound to a loopback or private address when it is meant to be reachable only through Apache. If the backend must be reachable from another host, restrict that network path instead of making the application independently public by accident.
Make configuration changes incrementally. First prove that a simple request reaches one backend. Then test redirects, authenticated pages, static assets, and any special protocol. A working home page does not prove that the public base path, cookies, or upgrade endpoints are correct.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What are ProxyPass and ProxyPassReverse used for?
ProxyPass maps a client-facing URL path to a backend URL. ProxyPassReverse changes redirect-related response headers from the backend so that a browser follows the public hostname rather than an internal hostname.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Apache documents that ProxyPassReverse adjusts the Location, Content-Location, and URI headers. It does not rewrite absolute URLs embedded in an HTML response body. If an application emits links such as http://127.0.0.1:3000/account in its page source, configure the application’s public base URL or use a separately configured HTML-rewriting module where that is appropriate.
A redirect to a private hostname is therefore usually a mapping problem, not evidence that Apache failed to proxy the original request. Check that the local and backend paths in both directives match exactly.
These directives solve different halves of the request flow. ProxyPass controls where an incoming path goes; ProxyPassReverse protects the client-visible address when the backend sends a redirect back. You normally use them as a pair for the same path and backend prefix. A reverse proxy cannot infer every public URL from an application response, so the application still needs an accurate external hostname and base-path configuration.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow do I proxy only a subpath?
Give Apache a local prefix and a backend prefix when the application should appear below a path such as /app/ rather than at the site root.
<VirtualHost *:80>
ServerName app.example.com
ProxyPass /app/ http://127.0.0.1:3000/
ProxyPassReverse /app/ http://127.0.0.1:3000/
</VirtualHost>Apache combines the portion after the local prefix with the backend prefix. Keep trailing slashes consistent: when one side ends with a slash, the other should also end with a slash. Inconsistent slash placement can remove or duplicate a separator and send the application a path it does not recognize.
If some local paths must bypass a broad proxy rule, place the exclusions before that broad mapping. For example, a local health or administrative path that Apache itself serves must be matched before a root-level ProxyPass / .... Document the intended URL space so the application knows whether it is mounted at / or under /app/; this affects links, cookies, redirects, and any framework setting for a base path.
Path-specific routing is useful when one hostname fronts several services, but each service must agree about its prefix. Test a deep link rather than only the home page, because a browser may request a script or stylesheet at an absolute path outside the mounted prefix. Also check cookie paths and redirects after sign-in: a cookie scoped to the backend’s original path may not be sent on the public path.
How do I proxy WebSockets through Apache?
For Apache HTTP Server 2.4.47 and later, the current module reference documents WebSocket upgrade proxying with the upgrade=websocket parameter. Point the mapping at the backend’s WebSocket endpoint and verify that your installed version and backend framework support the same upgrade behavior.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
ProxyPass /socket/ http://127.0.0.1:3000/socket/ upgrade=websocketUse the WebSocket path only for the upgrade endpoint; keep ordinary HTTP routes on their normal mappings. A failed connection can result from an older Apache release, missing upgrade support, an incorrect endpoint, or a backend that is not accepting WebSocket handshakes. Check the Apache error log and the backend’s connection log while making one test connection.
Do not assume that a successful HTTP request proves an upgrade will work. Test the exact public WebSocket URL, confirm that the backend is listening on the corresponding endpoint, and verify that the installed Apache version supports the syntax you selected. Keep the WebSocket mapping’s local and backend prefixes aligned just as you would for ordinary HTTP traffic.
Which reverse-proxy layout should I choose?
Start with one explicit backend unless you have a clear routing or availability requirement. More elaborate layouts add operational work around health checks, sessions, observability, and failure handling.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Layout | Best fit | Important decisions | Trade-offs |
|---|---|---|---|
| Single backend at the site root | One application on one host and port | Backend reachability, redirects, cookies, and logs | Simplest URL space and troubleshooting, but no application-level failover |
| Path-specific mappings | Several applications under paths such as /app/ and /api/ |
Prefix order, trailing slashes, application base paths, and exclusion rules | One hostname can serve multiple services, but URL and cookie behavior is more complex |
| Balancer or cluster group | Multiple backend instances or a need for distribution and failover | Load distribution, health checks, session persistence, failure detection, and backend state | More resilience and capacity options, with more configuration and monitoring overhead |
Apache’s reverse-proxy documentation treats clusters, balancers, failover, and health checks as advanced patterns. Decide separately where TLS terminates, which component owns authentication, how client and backend logs are correlated, and how you will observe an unhealthy member. Do not add a balancer simply because a single mapping works; add it when a second backend solves a defined availability or load requirement.
A single-backend design generally has the lowest infrastructure and operational cost: one Apache host, one application endpoint, and one set of logs to inspect. A balancer group consumes more resources and requires health-check policy, member-failure handling, and a plan for sessions or shared state. Managed Linux or VPS hosting can provide the public Apache gateway and backend capacity, but compare current pricing, regions, support, and module access before selecting a provider.
How should TLS and public URLs fit into the design?
Choose deliberately whether TLS terminates at Apache or at another component in front of it. The public hostname, certificate configuration, redirects, and application cookie settings must agree with that choice. If Apache is the public TLS endpoint, test both the encrypted public URL and any intended redirect from an unencrypted URL; then confirm that backend-generated redirects still use the public scheme and hostname.
Applications mounted under a prefix need the same consistency. Their configured external URL should include the public host and, where required, the base path. Otherwise, an application may generate links to the backend address, omit /app/, or set cookies for a path the browser never requests. Header and URL behavior should be verified with real sign-in and sign-out flows, not inferred from a successful anonymous page.
Recommended Free Tools
How can I secure an Apache reverse proxy?
The most important boundary is to avoid accidentally enabling a forward proxy. Apache warns that open proxy servers are dangerous to both your network and the wider Internet. Keep ProxyRequests Off, use fixed backend destinations, and restrict who can administer Apache and the application.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Bind internal applications to loopback or a private interface when public direct access is unnecessary.
- Allow only the network paths Apache needs to reach the backend; firewall and authentication syntax depends on your operating system and application.
- Review every proxy mapping for unintended broad matches, especially a root mapping that could capture paths meant to be served locally.
- Terminate TLS at Apache only when that matches your security design, and ensure the public hostname, certificates, redirects, and cookie settings agree with that design.
- Keep Apache and the backend patched, and monitor both Apache’s access/error logs and the application’s logs.
A reverse proxy is not an authorization policy by itself. If the application requires login, client certificates, IP restrictions, or role checks, configure and test those controls explicitly rather than treating the proxy boundary as authentication.
Limit administrative access to the Apache host and configuration files, and avoid accepting a backend destination from a query parameter or other client-controlled value. Fixed mappings make the intended network boundary visible in review. When a backend must be reachable across hosts, restrict the route and verify that it is not also exposed through an unrelated public listener.
How do I test the configuration before putting it into service?
Test in layers so a failure is attributed to the correct component.
- Run the Apache configuration test and fix all syntax or module-loading errors before reloading.
- From the Apache host, connect to the backend address and port. A direct failure indicates an application, network, firewall, protocol, or socket problem rather than a URL-routing problem.
- Request the public hostname and confirm the expected status code and response body.
- Trigger an application redirect and verify that the browser remains on the public hostname. Inspect the response headers for
Location,Content-Location, andURI. - Open a page containing links, forms, scripts, and cookies. Check for internal absolute URLs, incorrect path prefixes, or cookie paths that prevent the browser from sending session cookies.
- If using WebSockets, test the upgrade endpoint separately and watch both logs during the handshake.
Record the Apache version, backend URL, public path, and the exact request that failed. This makes a later change to a path prefix or module easier to audit.
After a successful test, repeat it following a reload and after a backend restart. This catches assumptions about service startup order, stale sockets, or configuration that was edited but not actually loaded. Keep a small set of repeatable checks for the root page, one redirect, one authenticated or cookie-bearing request, a static asset, and any WebSocket endpoint.
Why is Apache returning a 502 or connection error?
A 502 or connection error generally means Apache cannot connect to the configured backend. Verify the destination from the Apache machine, not only from your workstation.
| Symptom | Likely cause | What to check |
|---|---|---|
| 502, timeout, or connection refused | Wrong address, port, protocol, Unix socket, stopped backend, or blocked network path | Backend process status, listening endpoint, protocol, local connectivity, firewall rules, and Apache error log |
| Browser is redirected to an internal hostname | Missing or mismatched ProxyPassReverse |
Matching local and backend prefixes in both directives and the backend’s redirect headers |
| Links or scripts point to the private backend | Absolute URLs were generated inside the HTML body | Application public-base-URL settings or an appropriate HTML-rewriting module; ProxyPassReverse does not rewrite page bodies |
| Paths contain a missing or doubled slash | Inconsistent trailing slashes in the mapping | Make the local and backend prefixes use corresponding slash conventions |
| Local files or health endpoints are unexpectedly proxied | An exclusion appears after a broad mapping | Move the exclusion before the broad rule and retest the intended URL space |
| WebSocket handshake fails | Apache version, upgrade handling, endpoint, or backend handshake mismatch | Confirm the installed version supports the chosen syntax, verify the endpoint, and inspect both logs |
For a Unix-socket backend, check both the socket path and the permissions under which Apache runs. A socket can exist while still being unusable by the web-server process. Treat socket reachability as a separate test from HTTP path matching, and use the Apache error log to distinguish permission failures from an application that is not listening.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What should I monitor after Apache is working?
Watch for more than a successful home-page response. Apache access logs show which public paths are requested and which status codes are returned; error logs reveal connection, module, and upgrade failures. Backend logs show whether requests arrive with the expected path and whether the application is producing redirects or errors.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
For path-mounted applications, test sign-in, sign-out, redirects, static assets, form submissions, cookies, and deep links. For a balancer group, add health checks and define what happens when a member fails; also decide whether sessions require persistence or shared application state. These operational choices determine whether a proxy remains reliable after the initial configuration.
Correlate an individual failed request across the Apache access log, Apache error log, and backend log. The public path, backend path, response status, and redirect target should tell one consistent story. Review those records after configuration changes, module updates, and backend deployments so a routing regression is found before users report broken links.
Deployment checklist
- Public DNS resolves to the Apache host and the intended virtual host answers for that name.
- The required proxy modules are loaded for the backend protocol and, if applicable, WebSocket upgrades.
ProxyRequests Offis set, and no broad mapping unintentionally creates a forward proxy or captures local resources.- Every
ProxyPasshas a matchingProxyPassReversewith consistent prefixes and trailing slashes. - The Apache host can reach the backend address, port, protocol, or Unix socket with the permissions used by the service.
- The configuration test passes before each reload.
- Public redirects, cookies, generated links, static assets, deep links, and WebSocket handshakes have been tested.
- Logs, health checks, failure handling, and session behavior are defined for the chosen single-backend or balancer layout.
Frequently Asked Questions
Can I run Apache reverse proxy and a regular website on the same server?
Yes. Use separate virtual hosts or explicit path mappings, making sure the public hostnames and prefixes do not overlap unexpectedly. Put any local-path exclusions before a broad proxy rule so Apache serves those resources itself.
What happens if the backend is temporarily down?
Apache cannot manufacture an application response; requests normally fail with a gateway or connection error until the backend becomes reachable again. A balancer group with health checks can route around failed members, but that requires additional configuration and an appropriate session strategy.
Does Apache automatically rewrite an application’s HTML links?
No. Reverse-proxy response-header rewriting does not alter absolute URLs embedded in HTML, JavaScript, or other response bodies. Prefer configuring the application with its public base URL; use a dedicated body-rewriting module only after assessing its compatibility and cost.
Can the backend use a Unix socket instead of a TCP port?
Apache can be deployed with backends that use Unix sockets when the relevant proxy syntax and permissions are supported by the installed version. Treat the socket path and its filesystem permissions as part of the reachability test, and inspect the error log if Apache cannot connect.
Why do trailing slashes matter in ProxyPass rules?
Apache joins the path that follows the local prefix to the backend prefix. Matching slash conventions on both sides avoids missing or doubled separators and prevents requests from reaching an unexpected backend path.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do I know whether to use one backend or a balancer?
Use one explicit backend when simplicity is the priority. Choose a balancer or cluster when you have multiple instances, a defined distribution requirement, or failover needs, and plan health checks, session handling, monitoring, and the additional operating cost.
Is ProxyPassReverse enough to protect my application’s public URL?
It rewrites redirect-related response headers, including Location, Content-Location, and URI. It does not rewrite absolute links in HTML or JavaScript, so configure the application’s external URL and base path as well.
Can Apache terminate TLS while the backend uses HTTP?
Yes, when that matches your design and the required modules and virtual-host configuration are present. Verify that certificates, public redirects, cookie settings, and application-generated URLs all continue to use the intended public hostname and scheme.
The Bottom Line
For most deployments, begin with one fixed backend and a small virtual host: load the required proxy modules, pair ProxyPass with ProxyPassReverse, keep ProxyRequests Off, and verify the mapping from the Apache host. Then test redirects, cookies, generated URLs, subpaths, and WebSockets before adding path complexity or a balancer. Keep the backend private when appropriate, monitor both layers, and treat configuration validation and log review as part of every change.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
