Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe clearest production setup is to let Apache HTTP Server own public TCP port 80 and reverse-proxy requests to Tomcat on a local, unprivileged connector such as port 8080. Tomcat then remains isolated from the public network, while Apache handles the public listener and can terminate TLS. Configure Tomcat’s proxyName and proxyPort to the public host and port so redirects and absolute links do not leak :8080.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What it means to expose Tomcat on port 80
A browser connecting to http://www.example.com/ uses TCP port 80 by default. Your Tomcat application may still listen on 8080; a web server at the edge accepts the browser connection and forwards the request to Tomcat. The browser sees port 80, while the application server uses its private backend port.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Apache Tomcat 7 | $40.00 | Buy on Amazon |
| 2 |
|
Apache: The Definitive Guide (3rd Edition) | $26.20 | Buy on Amazon |
| 3 |
|
Professional Apache Tomcat | $9.46 | Buy on Amazon |
| 4 |
|
Apache Tomcat 7 Essentials | $39.99 | Buy on Amazon |
| 5 |
|
Tomcat: The Definitive Guide | $28.00 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Tomcat’s HTTP Connector port attribute chooses the TCP port on which Tomcat creates its server socket. The operating system permits only one listening server for a particular IP address and port, so Tomcat and Apache cannot both bind the same address on port 80. This is why a reverse proxy is normally preferable to moving Tomcat itself to 80.
Choose an architecture before changing configuration
| Architecture | Privilege requirement | Operational isolation | TLS and headers | Backend exposure | When it fits |
|---|---|---|---|---|---|
| Apache HTTP reverse proxy to Tomcat HTTP | Apache needs the public listener; Tomcat can stay on an unprivileged port such as 8080 | Strong separation between edge and application process | Apache can terminate TLS; proxy identity and forwarded-header handling must be configured | Tomcat can bind to loopback or a protected interface | Default choice for most deployments |
| Tomcat listening directly on 80 | Tomcat requires an operating-system privilege mechanism or service arrangement that grants permission to bind a privileged Unix port | Less process separation; the application server owns the public socket | No separate edge layer unless another service is added | Tomcat is directly reachable on the public listener | Small, deliberate deployments where the privilege coupling is acceptable |
Apache mod_proxy_ajp to Tomcat AJP |
Apache owns port 80; Tomcat uses its AJP connector | Separate edge and application processes, but with an additional protocol | Apache can terminate TLS; AJP remains a backend protocol | AJP should be restricted to a trusted network | Existing Apache/Tomcat environments that already require AJP |
HTTP proxying is usually the easiest design to understand and operate. Direct binding is topologically simple but couples Tomcat to a privileged socket. AJP is optional rather than a requirement for making an application available on port 80.
#1 Best Overall
Recommended design: Apache on 80, Tomcat on 8080
1. Confirm the application path and connector
Identify the Tomcat context path. If the deployed application is named myapp, its backend URL is typically http://127.0.0.1:8080/myapp. Confirm which Tomcat HTTP Connector is active and note its port. Remove connectors you do not use; Tomcat’s security guidance recommends minimizing listening connectors.
Also verify the address on which that connector listens. A connector bound to loopback can be reached only from the same host, while a connector bound to a private interface can support a separately hosted proxy but needs network controls. Do not assume that a port number alone identifies the service; the IP address, connector protocol, context path, and virtual-host configuration all matter.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Restrict the Tomcat listener
When Apache and Tomcat run on the same host, bind the backend connector to loopback where feasible, or protect the connector with a firewall and a private interface. The objective is that clients reach Apache, not the 8080 socket directly. A loopback listener also prevents another machine from bypassing the edge server’s access controls, logging, and TLS policy.
Test the restriction deliberately. A local request to the backend should work from the proxy host, while an external request to the backend address should fail or be filtered. Keep this distinction documented so a later firewall or service change does not accidentally publish Tomcat.
3. Make Apache listen on port 80
Configure the Apache virtual host or server instance to listen on TCP port 80. Before reloading Apache, verify that no other process already owns that address and port; only one process can bind a given IP/port pair. Enable the distribution’s Apache proxy modules, including mod_proxy and mod_proxy_http, using the package-management or module commands appropriate to that operating system.
If the host has several addresses, confirm which address the virtual host and Listen directive cover. A service may successfully bind one address while another service owns port 80 on a different address. Test with the public hostname, not only with a numeric address, because virtual-host selection depends on the request’s host name.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Add the reverse-proxy rules
For an application available under /myapp, use matching forward and reverse rules:
ProxyRequests Off
ProxyPass /myapp http://127.0.0.1:8080/myapp
ProxyPassReverse /myapp http://127.0.0.1:8080/myappProxyRequests Off keeps Apache in reverse-proxy mode rather than becoming an open forward proxy. ProxyPass sends incoming requests to Tomcat. ProxyPassReverse rewrites redirect response headers from the backend so clients continue to use the public URL.
Keep the path portions consistent. A rule for /myapp should target the corresponding Tomcat context, and rules with or without a trailing slash should be tested explicitly. Inconsistent path boundaries can produce doubled paths, missing slashes, or redirects to an unexpected context. Proxy only the application path unless the whole virtual host is intentionally dedicated to that application.
Rank #2
Place the directives in the virtual host that serves the public hostname, then validate the Apache configuration with the validation command supplied by your platform before reloading or restarting the service. A syntax error should be fixed before attempting a reload.
5. Set the public identity in Tomcat
Tomcat otherwise sees the connection from Apache and may believe that the request arrived on 127.0.0.1:8080. Add the public host and port to the HTTP Connector:
<Connector port="8080"
proxyName="www.example.com"
proxyPort="80" />proxyName and proxyPort tell Tomcat what the client-facing endpoint is. Without them, request.getServerName() and request.getServerPort() can reflect Apache’s backend connection instead of the host and port requested by the client. Frameworks that build absolute links, session redirects, password-reset URLs, or canonical URLs then risk emitting http://www.example.com:8080/... or a loopback hostname.
Restart or reload Tomcat according to your service arrangement after changing the Connector. Keep the actual port at 8080 (or another protected backend port); proxyPort="80" describes the public URL and does not move the socket.
6. Account for HTTPS termination
If Apache terminates TLS and forwards plain HTTP to Tomcat, configure the Connector’s scheme and secure settings, or the web framework’s trusted-forwarded-header support, so the application knows the original request was HTTPS. Use the mechanism documented for your deployed stack and trust forwarding headers only from your proxy. Blindly accepting client-supplied forwarding headers allows a direct client to impersonate the proxy and can produce incorrect redirects or security decisions.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Check all URL-producing features after this change: login redirects, logout links, form actions, password-reset messages, canonical links, and secure-cookie attributes. A page that loads successfully can still be misconfigured if one of these responses contains the backend scheme, host, or port.
7. Reload and test both layers
After Apache and Tomcat are running, inspect the edge access log and the Tomcat log while making requests. Test the root path and the application context from the server, then repeat from an external client:
curl -i http://127.0.0.1/myapp
curl -i http://www.example.com/myappUse the real public hostname in the external test. Check the status code, Location headers, generated links, and the logs on both sides. A successful response proves the request crossed the edge; a redirect that names 8080 indicates that public identity settings are incomplete.
Test more than the landing page. Follow a redirect, request a static asset, submit an authenticated request if available, and try both the context path and its trailing-slash variant. Compare the Apache request log with the Tomcat log to confirm that the same request identifier, path, and status can be traced through both layers. This also distinguishes an application error from a proxy routing error.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- Used Book in Good Condition
Mapping the root URL instead of a context path
If visitors should reach the application at http://www.example.com/ rather than /myapp, map Apache’s root path to the correct Tomcat context using a deliberate rule. Do not guess the context name: verify the deployed context first. Keep the forward and reverse mappings consistent, and test URLs containing redirects, static assets, and trailing slashes. Applications that assume they live at a non-root context may also need their own context or base-URL setting changed.
Root mapping deserves extra care because a broad / rule can unintentionally proxy administrative paths or other applications on the same virtual host. Decide whether the virtual host is dedicated to one application before choosing a catch-all mapping. If it is not dedicated, use an explicit context path and separate rules so unrelated resources are not forwarded to Tomcat.
When direct Tomcat binding to port 80 is appropriate
Tomcat can be configured with port="80", but Unix-like operating systems normally treat ports below 1024 as privileged. The service therefore needs an operating-system privilege mechanism or a service arrangement that grants only the required bind capability. The exact mechanism depends on the operating system and service manager; it should be designed as a least-privilege policy rather than running the whole application with unrestricted administrative rights.
Direct binding removes one proxy hop and can be attractive for a tightly controlled single-service host. It also means Tomcat owns the public socket, is directly exposed to Internet traffic, and must provide every edge concern itself or rely on another layer later. There is no second process available to terminate TLS, enforce edge policy, absorb malformed traffic, or provide an independent access log. Choose it only when that coupling is intentional, documented, and monitored.
Remember that changing the connector to 80 does not solve hostname or scheme issues by itself. The application still needs correct proxy or request settings whenever another load balancer, TLS terminator, or forwarding layer exists. Direct exposure also makes every enabled Tomcat connector part of the attack surface, which is another reason to remove listeners that are not required.
Using AJP instead of HTTP
Apache can forward to Tomcat’s AJP connector with mod_proxy_ajp:
ProxyPass "/myapp" "ajp://127.0.0.1:8009/myapp"AJP is a clear-text backend protocol. Tomcat security guidance says AJP Connectors should normally be used only on trusted networks. Keep the connector on loopback or another protected network, block untrusted access with firewall rules, and configure the AJP secret required by current Tomcat versions. The exact secret configuration is version-specific, so follow the settings for the Tomcat release you run.
For a same-host deployment, HTTP proxying is generally simpler unless an existing architecture requires AJP. Do not expose an AJP port to the public Internet merely because Apache is already present. Treat AJP as a separate trust boundary: Apache must be the only expected client, and any change to the network layout should trigger a review of the connector address, firewall, and secret.
Performance, operations, and security trade-offs
The reverse-proxy design adds a process and a local hop, but it also gives the deployment a clear edge boundary. Apache can own port 80, terminate TLS, maintain an edge access log, and apply virtual-host policy while Tomcat stays on a private connector. Measure the complete workload if latency or throughput is important; do not choose direct binding solely on the assumption that eliminating one hop will improve the application.
Rank #4
Direct binding has fewer moving parts in a single-service topology, yet the privilege needed for port 80 and the public exposure of Tomcat become part of routine operations. HTTP reverse proxying generally offers the best separation and the fewest protocol-specific security decisions. AJP can fit an established architecture, but it adds a clear-text protocol, a connector to protect, and a version-specific secret requirement.
Common failures and precise fixes
Apache cannot start: address already in use
Another process already owns the configured IP and port, or a second Apache instance is trying to bind it. Identify the listener with the operating system’s socket-inspection tools, stop or reconfigure the conflicting service, and ensure only one intended edge server listens on port 80.
502 or 503 from Apache
Apache cannot reach the backend. Confirm that Tomcat is running, that its Connector is actually on the port in ProxyPass, and that the address is correct. If Tomcat is bound to loopback, Apache must run on that same host. If a firewall protects the backend interface, allow the Apache-to-Tomcat connection while continuing to deny public access.
404 from Tomcat
The proxy path and deployed context do not match. Verify the context path, then make the ProxyPass and ProxyPassReverse targets use that path. Test the backend URL locally before testing through Apache; this separates a deployment problem from a proxy-routing problem.
Redirects still contain :8080 or a loopback name
Set proxyName to the public hostname and proxyPort="80" on the Connector, then restart Tomcat. Keep ProxyPassReverse in Apache as well; the two settings solve different sides of the problem. Also check application-level base-URL settings if the framework overrides servlet request values.
HTTPS redirects point to HTTP, or secure cookies behave incorrectly
When TLS ends at Apache, Tomcat receives an HTTP backend request unless the proxy communicates the original scheme through trusted headers. Configure the Connector’s scheme/secure behavior or the framework’s trusted-forwarded-header support, and ensure only Apache is trusted to set those headers. Re-test both redirects and cookie attributes through the public HTTPS endpoint.
AJP connection fails after a Tomcat upgrade
Current Tomcat releases require the configured AJP secret by default. A missing or mismatched secret, a disabled connector, or an inaccessible backend address will prevent the proxy connection. Configure the version-appropriate secret, restrict the connector to the trusted network, and inspect both Apache and Tomcat logs for the precise handshake error.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesHardening and maintenance checklist
- Keep Apache as the sole public listener on port 80 and confirm the intended hostname or virtual host receives the request.
- Bind Tomcat’s backend HTTP connector to loopback or a protected interface whenever the topology permits.
- Use
ProxyRequests Off,ProxyPass, andProxyPassReversefor the application path. - Enable only the Apache proxy modules required by the chosen backend protocol.
- Set Tomcat’s
proxyNameandproxyPortto the public endpoint whenever the application creates absolute URLs. - If TLS terminates at Apache, configure scheme, secure, and trusted-forwarded-header handling for the deployed framework.
- Remove unused Tomcat Connectors, including obsolete AJP listeners.
- If AJP is required, keep it on a trusted network and configure the current Tomcat version’s secret.
- Review Apache access logs and Tomcat logs together when diagnosing failures.
- Test
/, the application context, redirects, static resources, and absolute links from both the server and an external client. - Recheck listener addresses and firewall rules after upgrades, migrations, or changes to the proxy host.
Decision summary
Use Apache HTTP Server on port 80 with Tomcat on a private HTTP connector when you want the safest, clearest separation of responsibilities. Direct Tomcat binding is possible but introduces privileged-port coupling and removes the independent edge layer. AJP remains a specialized option for trusted, established Apache/Tomcat deployments; it is not a reason to expose an additional public port. Whichever design you choose, make the public identity explicit and keep unused listeners closed.
Frequently Asked Questions
Can Tomcat itself listen directly on port 80?
Yes. Set the HTTP Connector’s port to 80, but Unix-like systems normally require a privilege mechanism or service arrangement that grants permission to bind a port below 1024. This couples Tomcat to the public socket and removes the independent edge layer, so Apache-to-Tomcat HTTP proxying is usually the safer default.
Best Value
Why do redirects still show :8080 after I configured Apache?
ProxyPassReverse handles redirect response headers at Apache, while Tomcat’s proxyName and proxyPort make servlet request values represent the public endpoint. Configure both, restart Tomcat, and check application-level base-URL settings if the framework overrides those values.
Do I need AJP to expose Tomcat on port 80?
No. Apache can proxy ordinary HTTP with mod_proxy_http, and that is generally simpler for a same-host deployment. AJP is mainly for an existing Apache/Tomcat design that requires it.
Recommended Free Tools
Is it safe to expose the AJP port publicly?
No. AJP is clear text and Tomcat guidance says AJP connectors should normally be used only on trusted networks. Bind it to loopback or a protected interface, filter it with firewall rules, and configure the secret required by your Tomcat version.
What should I do if Apache returns 502 or 503?
Verify that Tomcat is running, the connector port matches the ProxyPass target, and the backend address is reachable from Apache. A loopback-bound connector requires Apache to run on the same host. Check both Apache and Tomcat logs while making a request.
Can two services share port 80?
Not on the same IP address. The operating system allows only one listening server application for a particular IP-and-port pair. Use one edge listener and proxy to a different backend port, or assign distinct IP addresses deliberately.
How can I verify that Tomcat is not publicly reachable?
Confirm the connector binds to loopback or a protected interface, test the backend locally from the proxy host, and attempt an external connection to the backend address. The external attempt should be blocked or fail while the Apache public URL succeeds.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat changes when Apache terminates HTTPS?
Tomcat receives a plain HTTP backend connection unless the original scheme is conveyed through trusted proxy headers or connector settings. Configure scheme, secure, and forwarded-header handling for your stack, trust only Apache to set those headers, and test redirects and secure cookies through the public HTTPS endpoint.
The Bottom Line
Put Apache HTTP Server on public port 80, keep Tomcat on a protected connector such as 8080, and connect them with ProxyPass and ProxyPassReverse. Set proxyName and proxyPort to the public endpoint, restrict or remove unused connectors, and reserve AJP for trusted networks with the required secret.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
