How to install Apache on Ubuntu and Debian: virtual hosts, PHP-FPM and HTTPS

Short answer: run sudo apt install apache2 on Ubuntu or Debian. Apache starts right away and serves its default page on port 80. Open HTTP and HTTPS in ufw, put each site in /etc/apache2/sites-available, enable it with a2ensite, check with apache2ctl configtest and reload. For HTTPS, run certbot --apache. On Rocky Linux and AlmaLinux the package is httpd.

sudo apt update
sudo apt install -y apache2
systemctl status apache2 --no-pager
apache2ctl -v

The paths, helper scripts and messages below follow Debian’s apache2 packaging (version 2.4.68-1~deb12u1 in the Debian 12 package index on our server), Ubuntu’s packaging and the documentation on httpd.apache.org, read on 21 October 2026. The Debian ufw profile names (WWW Full, OpenSSH) were checked in /etc/ufw/applications.d on Debian 12 with ufw 0.36.2; the Ubuntu ones (Apache, Apache Secure, Apache Full) come from Ubuntu’s apache2 packaging. Apache itself was not run for this guide, so outputs are marked as examples. The newest upstream release is 2.4.69 (1 October 2026); distributions keep their own 2.4.x and backport security fixes, so apache2ctl -v shows a lower number on a fully patched server.

Open ports 80 and 443 in ufw

Open ports 80 and 443: 443 for HTTPS, 80 for redirects and for Let’s Encrypt’s HTTP check. Ubuntu’s apache2 package adds three ufw profiles; Debian’s does not, but ufw itself ships a profile with the same ports:

sudo ufw allow OpenSSH          # first, so you keep your SSH session
sudo ufw allow "Apache Full"    # Ubuntu only: 80 and 443
sudo ufw allow "WWW Full"       # Debian only: the same ports, from ufw's own profile
sudo ufw enable
sudo ufw app list

Then open http://YOUR-SERVER-IP/. The “Apache2 Debian Default Page” (or the Ubuntu one) is /var/www/html/index.html. More rules, such as limiting SSH to your own address, are in the ufw guide.

The Debian and Ubuntu layout

Debian splits Apache’s configuration into small files and gives you scripts that switch them on and off with symlinks, so you rarely edit the main file:

$ sudo a2enmod rewrite
Enabling module rewrite.
To activate the new configuration, you need to run:
  systemctl restart apache2

The scripts suggest a restart for modules and a reload for sites and config snippets. Run apache2ctl configtest before either: a reload with a broken file keeps the old configuration running, but a restart with one leaves Apache stopped. The full list of service commands is in systemctl commands.

Set up a virtual host for your domain

1. 1Point the domain at the server

   Create A (and AAAA) records for example.com and www.example.com with your server’s address, as described in pointing a domain to a VPS. You can build the site while DNS propagates.

2. 2Create the document root

   sudo mkdir -p /var/www/example.com/public
   echo '<h1>example.com works</h1>' | sudo tee /var/www/example.com/public/index.html

3. 3Write the site file

   <VirtualHost *:80>
       ServerName example.com
       ServerAlias www.example.com
       DocumentRoot /var/www/example.com/public
   
       <Directory /var/www/example.com/public>
           Options -Indexes +FollowSymLinks
           AllowOverride All
           Require all granted
       </Directory>
   
       ErrorLog ${APACHE_LOG_DIR}/example.com-error.log
       CustomLog ${APACHE_LOG_DIR}/example.com-access.log combined
   </VirtualHost>

4. 4Enable it, test, reload

   sudo a2ensite example.com
   sudo a2dissite 000-default
   sudo apache2ctl configtest
   sudo systemctl reload apache2
   curl -H "Host: example.com" http://127.0.0.1/

   configtest should end with Syntax OK. The curl line asks for the site by name before DNS has caught up.

AllowOverride All is there for .htaccess files. Debian’s apache2.conf sets AllowOverride None for /var/www/, so without this line every .htaccess rewrite is silently ignored; with it, also run sudo a2enmod rewrite. The Apache documentation recommends putting rules into the site file instead where you can, because with overrides allowed Apache looks for .htaccess in every directory on every request. Debian also only grants access to /var/www and /usr/share; a document root under /srv needs its own <Directory> block with Require all granted, or visitors get a 403 Forbidden.

The AH00558 ServerName warning

AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message

Harmless, but easy to silence with a global ServerName, ideally the server’s fully qualified domain name:

echo "ServerName server1.example.com" | sudo tee /etc/apache2/conf-available/servername.conf
sudo a2enconf servername
sudo systemctl reload apache2

PHP: PHP-FPM with proxy_fcgi, or mod_php

Debian and Ubuntu run Apache with the event MPM, which handles many idle keep-alive connections with few threads. PHP-FPM keeps it that way:

sudo apt install -y php-fpm
sudo a2enmod proxy_fcgi setenvif
sudo a2enconf php8.2-fpm
sudo systemctl restart apache2

NOTICE: Not enabling PHP 8.2 FPM by default.
NOTICE: To enable PHP 8.2 FPM in Apache2 do:
NOTICE: a2enmod proxy_fcgi setenvif
NOTICE: a2enconf php8.2-fpm
NOTICE: You are seeing this message because you have apache2 package installed.

Use the version your release ships: php8.3-fpm on Ubuntu 24.04, php8.4-fpm on Debian 13; ls /etc/apache2/conf-available/ | grep fpm shows the name. The snippet hands every .php file to the FPM socket in /run/php/. To test, put <?php phpinfo(); into a file in the document root, look for “Server API: FPM/FastCGI”, then delete the file. PHP settings now live in /etc/php/8.2/fpm/php.ini, not the Apache one, which is where most memory_limit changes go wrong.

With PHP in place, the database half of a LAMP stack is covered in installing MariaDB or MySQL.

HTTPS with Certbot

sudo apt install -y certbot python3-certbot-apache
sudo certbot --apache -d example.com -d www.example.com
sudo certbot renew --dry-run

Certbot proves control of the domain over port 80, so DNS must already point at the server and the firewall must let port 80 in. It then writes a second site file, example.com-le-ssl.conf, enables mod_ssl and that site, and by default adds a redirect from HTTP to HTTPS. The Debian and Ubuntu package renews through a systemd timer (systemctl list-timers | grep certbot), and the dry run proves that renewal will work.

Logs and troubleshooting

sudo tail -f /var/log/apache2/error.log
sudo tail -f /var/log/apache2/example.com-access.log
sudo journalctl -u apache2 -n 50 --no-pager

The error log names the file and the cause for most problems; when Apache does not start at all, journalctl has the reason. tail -f keeps the log open while you reload the page. Sites without their own CustomLog write to other_vhosts_access.log.

Rocky Linux and AlmaLinux: httpd

sudo dnf install -y httpd
sudo systemctl enable --now httpd
sudo firewall-cmd --permanent --add-service=http --add-service=https
sudo firewall-cmd --reload
sudo apachectl configtest

SELinux is the usual surprise. A document root outside /var/www needs the right label, and Apache may only open outgoing connections, for example to a backend it proxies to, once a boolean allows it:

sudo semanage fcontext -a -t httpd_sys_content_t "/srv/www(/.*)?"
sudo restorecon -Rv /srv/www
sudo setsebool -P httpd_can_network_connect 1

Apache or nginx?

Both are fast enough for nearly any site on one server. How the two differ under the hood is in what nginx is and how it works.

Running both: Apache behind nginx

Only one program can own port 80. A common split is nginx in front for TLS and static files and Apache behind it for the PHP sites whose .htaccess rules nobody wants to translate:

1. 1Move Apache to localhost:8080

   # ports.conf: replace "Listen 80"
   Listen 127.0.0.1:8080
   
   # sites-available/example.com.conf
   <VirtualHost 127.0.0.1:8080>
       ...
       SetEnvIf X-Forwarded-Proto https HTTPS=on
   </VirtualHost>

   The SetEnvIf line tells PHP applications that the visitor used HTTPS, which prevents redirect loops in WordPress and similar apps. Disable mod_ssl and the -le-ssl site if Certbot had set them up, since nginx now handles TLS.

2. 2Log the real visitor address

   RemoteIPHeader X-Forwarded-For
   RemoteIPInternalProxy 127.0.0.1

   Run sudo a2enmod remoteip and sudo a2enconf remoteip, and change %h to %a in the LogFormat lines of apache2.conf, so the log shows the visitor instead of 127.0.0.1.

3. 3Proxy from nginx

   server {
       listen 80;
       server_name example.com www.example.com;
   
       location / {
           proxy_pass http://127.0.0.1:8080;
           proxy_set_header Host $host;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto $scheme;
       }
   }

   Restart Apache first, then reload nginx. TLS on the nginx side works as in nginx as a reverse proxy with SSL.

Apache on a VPS

• Memory: Apache with PHP-FPM, MariaDB and a small WordPress site fit on the smallest Standard KVM plan (2 cores, 4 GB RAM). With mod_php and prefork, every Apache process carries PHP, so the same traffic needs more RAM.
• Images: our Ubuntu and Debian VPS images take the apt commands on this page as written, with full root access and always-on DDoS protection in front.
• No server to run: if you only need websites, our Plesk hosting includes free auto-renewing SSL and the WordPress Toolkit, and the web server is managed for you.

Frequently asked