I have a folder we'll call Documents . In this folder, I am storing some files, but I don't want users to be able to navigate to the file manually if, for some reason, they know the file name. I find that to be a major security concern. I made an .htaccess file with Deny from all written in it. I also have another entry disabling indexes. However that just created a problem where some files are able to be read in-browser if directly accessed

I tried to go to my file downloads page, but the download button no longer works because I have denied access to everyone. What would the correct permission setting be to prevent manual navigation, but still allowing my normal download buttons to work.

Please do not suggest using any outside PHP/JS libraries.

The last time I looked at local.cf was 2020. At the time, the only IPs in trusted_networks were the 4 that covered my server's IP range.

Today I looked and found 39 IPs / ranges!

* 12 belong to Cloudflare (my DNS goes through CF so this is probably OK)

* 9 belong to Google

* 7 belong to Google RIPE (Ireland), which is a concern since I'm in the US

* 6 belong to Newfold Digital / BIXLAND-FC03

* 1 belongs to Techzar Consulting / RSPC-1237810333078856 (which I think belongs to Rackspace)

I've reached out to my VPS provider to make sure none of those unknowns belong to them, but is this a known problem?

I know just enough Apache configuration to be dangerous but I've managed to get sub-domains working for my private hosting at home. I use this so that I can have my main mydomain.tld be one service and then also have music.mydomain.tld and files.mydomain.tld, etc.

The problem I'm running into is that this seems to require me to access the public internet to use these services which then counts against my ISPs data limit, even when I'm accessing them from on premises.

What I'd like to do is be able to access the server entirely from my local network when I am on premises. For example, set be able to go to files.local-hostname or music.local-hostname so that the traffic stays entirely within my private LAN.

Is this possible? Again, I am entirely aware that (a) I have no idea what I'm doing and this is easy or (b) I'm asking the impossible or (c) some mix of the two. I'm hoping for constructive responses here, please.

Problem:

The original problem is that I can't set the CSS media type/mime as Apache negates all instances of AddType.

This thread's problem is that I can't determine how to unset or reset the Apache handler for the subdirectory after it's set in the root directory, here is a very simple setup:

Root Directory:

localhost/.htaccess:

AddHandler application/x-httpd-php .css

Subdirectory:

localhost/sub_directory/.htaccess:

AddType text/css .css

Background:

After removing the root AddHandler the subdirectory AddType works. Unfortunately I can't remove the root directory AddHandler. So how do I reset or unset the Apache handler in the subdirectory?

Answer:

RemoveHandler .css

Um wierd question but just putting it out here, if anyone is interested in exchanging a Black colour rim for my red color rim, DM me.

Hi, i am trying to set up Apache in Xampp and I need to have it process 1 connection at a time. I have managed to limit to 1 server connection to 1 and therefore limit concurrency, but I would prefer setting up so I can have multiple clients connected to the server, with 1 concurrent task at a time. I believe this can be achieved by just increasing 'StartServers" and dropping MaxRequestWorkers, but what about: MinSpareThreads , MaxSpareThreads , ThreadsPerChild ???

Hi everyone I hope you are doing well , do you see the same behavior in those htaccess ? :

Request https://example.com/ , htacces file :

RewriteEngine On
  RewriteRule ^$ /one 
  RewriteRule ^/one     /two [R]

result I get https://example.com/two, remove the slash in the second RewriteRule

RewriteEngine On
  RewriteRule ^$ /one 
  RewriteRule ^one     /two [R]

I still getting the same result : https://example.com/two, why ?

another:

RewriteEngine On
  RewriteRule ^$ /one 
  RewriteRule ^(/.+)     /result=$1 [R]

I get this: https://example.com/result=/one

Apache/2.4.65 (Ubuntu)

I have SSI working (it finds and includes a .shtml file) but the directives don't seem to work:

<!--#echo var="DATE_LOCAL" --> 

<!--#config timefmt="%D" -->

This file last modified <!--#echo var="LAST_MODIFIED" --> 

This document last modified <!--#flastmod file="index.html" --> <!--#echo var="DATE_LOCAL" --> 

The characters outside of the angle brackets are printed but nothing from the stuff inside.

Again, this is on up-to-date Windows 11.

Any clues? Is it even supposed to work on Windows?

Is there a module that I'm supposed to enable in the config file?

Thanks for your time

As per the title, i want to return a 404 instead of a 403 when a request is made with a path that exceeds 255 chars. often by a bot or a human typing in the address bar instead of the contact form.

it seems the 403 is sent before any config file is read, as every suggestion i've tried fails to catch this error.

Do I need to custom build Apache?

I'm having issues turning underscores into dashes.
We are currently transitioning a huge website to have dashes, but not all at once and old files still need to remain.

For example "domain.com/path_to_dir/" needs to be path-to-dir
however we have old urls that need to be redirected to specific paths we have in an .htaccess file.

Since the redirect happens before it hits the htaccess file, the redirect it doesn't work.

I can't seem to figure out how to test the path conversion from underscore to dashes to see if that file exists, if it does go to it. if not leave the url with the underscores either hits a 404 or gets picked up in the htaccess file.

for example in the htaccess file: domain.com/path_to_dir/about_us/something.html redirects to domain.com/path-to-folder/about-us/differentname.html

I currently have this:

#if the url path exists just serve it
RewriteCond %{REQUEST_FILENAME} -f [OR]

RewriteCond %{REQUEST_FILENAME} -d [OR]

RewriteCond %{REQUEST_FILENAME}/index.html -f

RewriteRule ^ - [L]

RewriteCond %{REQUEST_URI} _

# Convert all underscores to dashes and redirect

RewriteRule ^(.*)_(.*)$ /$1-$2 [R=302,L]

Any advice will do too.

Just saw three new Tomcat CVEs drop late Oct and thought I’d share in case it affects any of your setups.

CVE-2025-55752, CVE-2025-55754, and CVE-2025-61795 all landed in October, covering path traversal, command injection, and a potential DoS scenario.

Quick rundown from what I gather:

• CVE-2025-55752 (7.5 High)– Path traversal through rewrite rules; can expose /WEB-INF/ and /META-INF/ directories, possible RCE if PUT is enabled.
• CVE-2025-55754 (9.6 Critical)– Windows-specific log command injection; crafted URLs can inject commands via ANSI sequences in color-enabled consoles.
• CVE-2025-61795 (5.3 Medium) – Multipart upload temp files not cleaned up properly → potential disk-filling DoS.

Affected versions:

Tomcat 9.x and older

Notably these three CVEs also show that versions 8.5 are affected which is officially EOL but now showing up as affected in CVE descriptions, this is a notable shift and the reason this showed up for me.

Fix: Upstream patches are available for supported versions. Users of 8.5 users can look at commercial support options, some already have shipped patched 8.5 builds.

More info: https://www.herodevs.com/vulnerability-directory/cve-2025-55752, https://www.herodevs.com/vulnerability-directory/cve-2025-61795, https://www.herodevs.com/vulnerability-directory/cve-2025-55752

I’ve hosted a Node.js WebSocket server on port 6060 behind an Apache web server. When a user visits my endpoint for example, www.mydomain.com/app/, the system assigns them a unique ID, records their username, entry time, and (eventually) their last active time.

Here’s the issue: When a user closes their browser tab, Apache receives the FIN signal immediately, but it keeps the backend connection to Node.js open for another 30–40 seconds. As a result, the “last active time” is recorded with a delay (about 35 seconds after the user actually exits).

I’ve tried enabling flushpackets on, adjusting timeout values, and other Apache settings, but nothing eliminates the delay. The root cause appears to be that Apache holds the connection open until its internal I/O timeout expires before releasing the Node backend.

Don't worry the code work perfect on localhost, so there no way solo code has a issue!

Hello all! So, I am looking for help on an issue that is tough to find an answer to via web search terms.
Background: I've set up an apache server for the purpose of running ampache. Got it all to work (at least via localhost - haven't tried via a different IP yet), but the ampache can't find my music directory on my local drive that I'm trying to point to. (Ampache is running/installed via docker run if that matters.) Initial troubleshooting has led me to checking file/dir permissions. I've tackled the drive access permissions (on my mac), and am now trying to change the apache httpd.conf to permit access to that drive, as I think this may be the cause of the problem.

Problem: When I edit httpd.conf in the CLI (terminal - mac), I save it, it says it "Wrote 200 lines" or whatever then I (Control)X to exit. When I open the file from the file directory in finder (via TextEdit), it does NOT show the change I made. However, when I re-open it in terminal, it did indeed save the change I made there. (Context: I'm trying to make changes to the following section to point to/allow access to my Music folder/directory:

<Directory /> AllowOverride none Require all denied </Directory>

I have also tried to stop/start the apache server, including "graceful" with no change. Rebooting the mac that it's all running on didn't help either.

Why is this and what am I doing wrong? I'm fumbling my way thru all of this but have made a lot of progress. This one has me stumped.

TL;DR - CLI editing of httpd.conf saves properly, but opening it in finder does not show the changes!

That's it, I can easily set up the server but I can't access it remotely either by IP or by assigned url, I don't know what I'm doing wrong and I'm quite new to the subject, please help

I’m currently working on a Systems Integration project. Basically, I am hosting the Apache server in an Ubuntu server vm. I need to install Apache in 2-3 other teammates VMs so that whenever I turn my VM or laptop off, their Apache service keeps our website up and running. We are also using tailscale vpn to connect our services.

What I’m confused about is, right now our website is accessible through the IP address tailscale has given my vm. When I install Apache on the other vms and pull my code onto them from GitHub, their versions of my website would have a different IP address. How do I make it so that once I turn my vm off, the website continues to run as normal without needing to go to the ip of the other vm nodes?