Free tools Windows power users keep installed
One-click scans. No signup required.
Apache AH00035 means the httpd worker could not traverse at least one directory in the filesystem path mapped to the request. Check the exact path in the error log, verify the Apache user can search every parent directory and read the file, then check Apache 2.4 authorization rules and SELinux labels before changing permissions. The least-privilege fix is usually a specific owner, group, directory search permission, file-read permission, or restored SELinux context—not chmod 777.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What AH00035 means
AH00035 is Apache’s way of reporting an operating-system path traversal failure. The request URL has already been mapped to a filesystem location, but the process serving the request cannot reach the target through one or more directory components. A directory’s execute bit is its search or traverse permission: it allows a process to pass through the directory when it already knows a name inside it. Apache needs that permission on every parent directory, plus read permission on the target file when it serves the file’s contents.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The Apache Software Foundation describes this condition as “access denied because search permissions are missing on a component of the path.” Its documentation also summarizes the underlying cause plainly: “Error 13 indicates a filesystem permissions problem.” The message does not mean only the final file has a bad mode. A single restrictive directory several levels above the file is enough to produce AH00035.
AH00035 identifies a different failure from an Apache authorization denial. Unix ownership and mode bits, Apache’s Require rules, and SELinux policy are separate enforcement layers. Fixing one layer does not automatically grant access through the others.
#1 Best Overall
Read the error log before changing anything
Capture the mapped filesystem path
Use the complete path printed in the AH00035 line, not merely the browser URL. For a request such as /manual/index.html, the mapped location might be /srv/sites/example/public/manual/index.html. Record that exact path, including capitalization and any directory named in the message as the component lacking search permission.
Do not guess from a virtual-host name. Different DocumentRoot values, aliases, and rewrite rules can map similar URLs to different directories. If the log rotates quickly, reproduce one request and capture the timestamp, virtual host, client URL, and full AH00035 entry together.
Identify the enforcing Apache account
Find the active Apache configuration’s User and Group directives. Common distributions use an account dedicated to httpd, but the name is distribution- and configuration-specific. A permission change made for the wrong account has no effect and can create a false sense of success.
Check the configuration actually loaded by the running service, including any included files and the virtual host handling the request. A package default may define one account while a custom service unit or container uses another.
Check every component of the path
Use namei when available
Run the following as a privileged administrator, replacing the path with the one from the log:
namei -m /full/path/to/file
namei -m prints each component and its mode, making a hidden parent-directory problem visible. Start at the filesystem root and read toward the target. Apache must be able to search each directory in sequence. If the output shows a parent without execute permission for the Apache user, its group, or the applicable “other” class, that is a filesystem-level cause of AH00035.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Inspect individual directories and the file
On systems without namei, inspect each component explicitly:
Rank #2
- Used Book in Good Condition
ls -ld / /srv /srv/sites /srv/sites/example /srv/sites/example/public /srv/sites/example/public/manual
Then inspect the target:
ls -l /srv/sites/example/public/manual/index.html
The -d option reports a directory itself rather than listing its contents. Compare the owner, group, and mode at every level. A file can show a seemingly normal mode while a parent directory blocks traversal.
Understand the minimum permissions
For ordinary static content, Apache generally needs directory search permission on every parent and file read permission on the target. Apache’s guidance commonly uses 755 for directories and 644 for ordinary files as a baseline, but those numbers are not universal requirements. A private group setup can provide the needed access with tighter “other” permissions, and local security policy may impose additional constraints.
| Object | Typical baseline in Apache guidance | What httpd needs | Important qualification |
|---|---|---|---|
| Parent directory | 755 |
Search/execute permission for the Apache identity on every component | Ownership, group membership, ACLs, and local policy may allow a narrower mode. |
| Ordinary file | 644 |
Read permission for the Apache identity | Write permission is not needed to serve a static file and should not be added merely to clear AH00035. |
| Target directory listing | Not stated | Search permission; listing also depends on Apache’s directory-index and authorization settings | A successful traversal check does not guarantee that directory browsing is enabled. |
Access control lists can grant or remove permissions beyond the displayed mode bits. If the conventional owner/group/mode check does not explain the denial, inspect any ACLs configured on the path and account for the effective permissions they produce.
Repair Unix ownership and modes narrowly
Correct the owner or group
If content belongs to the wrong account, change ownership to the account or deployment group that is supposed to manage it. If Apache should read through a shared group, add the httpd account to that group only when your operating procedure permits it, then start a new service process so the new supplementary-group membership is applied.
Do not make Apache the owner of an entire application tree simply because it needs to read a few files. Keeping deployment ownership separate from the serving identity limits the damage of a compromised web process.
Add only the missing search or read permission
When a single directory lacks search permission, grant that permission to the appropriate owner, group, or other class rather than making every directory world-writable. When the file is unreadable, grant read access through the intended owner or group. Preserve existing write restrictions.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsAfter each change, rerun namei -m and ls -l to verify the effective path. Fix one component at a time so you can identify the change that resolved the failure.
Never use chmod 777 as a diagnostic
Mode 777 grants read, write, and execute permissions to everyone. Apache explicitly warns that this is unsafe and diagnostically misleading: a request may begin working while the actual ownership, authorization, or labeling problem remains. It also exposes content to unwanted modification. Revert any broad test mode immediately and apply the smallest durable permission change instead.
Check Apache 2.4 authorization separately
Correct Unix modes do not override Apache’s own access rules. A <Directory> block, an inherited configuration, Require all denied, a security module, or a rate-limiting module can return a 403 after the operating system permits traversal.
Inspect the relevant <Directory> scope
For Apache 2.4, authorization should be granted in a path-specific block only when that directory is intentionally web-accessible:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute<Directory "/srv/site">
Require all granted
</Directory>
Use the real filesystem path, not the URL path. Keep the protective global rule—commonly <Directory /> Require all denied</Directory>—in place. Narrowly scoped access prevents unrelated parts of the server from becoming reachable when a virtual host is edited.
Look for inherited and module-based denials
Check included configuration files and virtual-host order for a more specific or inherited rule that still denies the request. A security module can reject a request after filesystem traversal, and a rate-limiting module can produce a denial that resembles a permissions problem from the browser’s perspective. Correlate the request timestamp with Apache’s error and audit logs. If the new log entry is an authorization message rather than AH00035, continue with the rule or module that generated it instead of repeatedly changing Unix modes.
Investigate SELinux when mode bits look correct
Confirm enforcement state
On SELinux-enabled systems, policy can deny the httpd domain even when owner, group, and mode output appears correct. Check the current state:
getenforce
A result of Enforcing means policy decisions are actively blocking operations. Do not disable SELinux as a shortcut; doing so removes a security boundary and hides the configuration defect.
Search for AVC denials
Inspect recent audit records around the failed request:
ausearch -m avc,selinux_err,user_avc -ts today -i
If your distribution routes audit data through the journal, use the equivalent journal query for AVC events. Match the timestamp, path, process, and SELinux type to the Apache request. Unrelated audit noise is not evidence that a new allow rule is needed.
Inspect and restore labels
Display security contexts on the path:
ls -Z /var/www/html
Files copied from another location or moved into a web root can retain an inappropriate label. Restore the policy-defined context recursively when that is the documented correction:
restorecon -Rv /var/www/html
A documented Plesk case resolved an AH00035 caused by an incorrect context with restorecon -Rv. The exact target directory must match your installation; do not blindly relabel unrelated data.
Create policy only from a confirmed denial
If labels are correct and an AVC record clearly identifies a legitimate application operation that policy blocks, follow the SELinux Project workflow to capture that denial and build a narrowly scoped local policy. Review each proposed permission. Never generate broad allow rules from unrelated audit entries, and do not treat a policy module as a substitute for correcting ownership, modes, or labels.
Distinguish the three main denial layers
| Where access fails | Enforcing identity or mechanism | Typical evidence | Narrowest reversible fix |
|---|---|---|---|
| Filesystem traversal or file read | Unix owner, group, mode, or ACL | AH00035 naming a path component; namei -m or ls -ld reveals a missing search/read permission |
Correct the specific owner, group, ACL, or permission bit. |
| Apache authorization | <Directory> rules, inherited configuration, or modules |
Apache authorization or module log messages; Unix checks pass | Adjust the intended path-specific rule or module configuration. |
| SELinux policy | SELinux domain, type, and policy | AVC records, SELinux errors, or a context mismatch; mode bits appear adequate | Restore the expected context or write a narrowly scoped policy based on the verified AVC. |
The order matters: start with the AH00035 path and operating-system checks, then evaluate Apache authorization, then SELinux evidence. This avoids masking a policy error with progressively weaker filesystem permissions.
Best Value
- Used Book in Good Condition
Validate the fix safely
- Run Apache’s syntax check. Use the platform’s command, commonly
apachectl configtest. Resolve any syntax error before reloading. - Reload through the local service manager. Distributions differ; use the established command for your installation, such as a reload of the Apache service. Restart only when a reload cannot apply the change or your operational procedure requires it.
- Request the exact URL again. Test the same virtual host and path that generated AH00035. A different host header can select a different configuration.
- Compare fresh logs. Determine whether AH00035 disappeared, changed to an authorization denial, or was replaced by an SELinux AVC. The new message identifies the next enforcement layer rather than proving the original fix was wrong.
- Retest after deployment changes. If content is recopied, restored, or moved, repeat the path and label checks because ownership and contexts can change during those operations.
Common scenarios and the correct branch
A parent directory is 700 and owned by another account
The Apache user cannot search the directory, even if the target file is 644. Grant search access through an appropriate group or adjust ownership according to the deployment design. Do not make the directory writable by everyone.
The path checks pass, but the response remains 403
Inspect the applicable Apache 2.4 <Directory> rules and included configuration. A global deny, a more-specific block, or a module can reject the request after the operating system allows it. The absence of a new AH00035 line points away from Unix traversal.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Modes are correct and an AVC appears at the request time
Inspect ls -Z and restore the expected context with restorecon when the file was moved or copied incorrectly. If the context is already correct, use the AVC details to determine whether a narrowly scoped policy change is justified.
A broad permission change made the page work
Undo the broad change, identify the exact blocked component with namei -m, and repair the intended owner, group, mode, ACL, or label. A successful response alone does not establish that the resulting configuration is safe.
The error returns after a release or restore
Compare the deployment process with the last working release. File copies can alter owner, group, mode, and SELinux context. Add explicit, repeatable ownership and context restoration to the deployment procedure rather than relying on an ad hoc manual fix.
Prevent AH00035 from recurring
- Keep application deployment ownership separate from the Apache serving identity unless the application genuinely requires shared ownership.
- Document the intended owner, group, directory search permissions, and file-read permissions for each web root.
- Keep Apache’s global filesystem deny protection and grant access only in path-specific
<Directory>blocks. - Preserve SELinux enforcement and include context verification after copy, extraction, restore, or migration operations.
- Monitor Apache error logs and SELinux audit records together so a change in denial layer is visible.
- Use configuration validation before every reload and test the exact virtual host and URL affected by a change.
- Remove temporary diagnostic permissions immediately and record the least-privilege correction that replaced them.
A compact decision checklist
- Copy the full filesystem path from the AH00035 log line.
- Identify the active Apache
UserandGroup. - Run
namei -m, or inspect every parent withls -ld, and verify target-file readability. - Repair only the failing owner, group, ACL, directory search bit, or file-read bit; never use
chmod 777. - Check path-specific Apache 2.4 authorization and inherited rules if filesystem checks pass.
- Run
getenforce, inspect AVC records, and check labels withls -Zwhen SELinux is enabled. - Use
restorecon -Rvfor a confirmed mislabeled tree, or develop a narrowly scoped policy only from a verified AVC. - Run
apachectl configtest, reload with the distribution’s service procedure, and compare new request and audit logs.
What to remember
AH00035 starts with a path traversal question: can the Apache worker search every directory component and read the requested file? Once that is established, Apache authorization and SELinux remain independent checks. Treat each denial as evidence from one enforcement layer, make the smallest reversible correction, and validate the result with fresh logs. That method fixes the immediate 403 without weakening the server’s security model.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
