Apache HTTP Server can sit in front of one or more application servers as a reverse proxy. Visitors connect to Apache at one public address; Apache forwards each request to a private backend and returns the backend response. A minimal HTTP setup requires the base mod_proxy module, the protocol-specific mod_proxy_http module, ProxyRequests Off, and matching ProxyPass and ProxyPassReverse directives.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
ProxyRequests Off
ProxyPass "/" "http://127.0.0.1:8080/"
ProxyPassReverse "/" "http://127.0.0.1:8080/"ProxyPass maps incoming paths to the backend. ProxyPassReverse changes redirect-related response headers so that a backend redirect continues to use the public Apache address. They solve different problems and are normally used together.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What Apache reverse-proxy mode does
In reverse-proxy mode, Apache is the public gateway and the application server is hidden behind it. The client does not connect directly to the backend. Apache receives the request, selects the configured backend, sends the request using the appropriate protocol module, and relays the response.
This arrangement is useful when you want to isolate an application server, expose several services through one hostname, centralize authentication, cache responses, or distribute traffic across multiple backends. It is also a common way to put a game API, account service, match-making endpoint, or WebSocket service behind one established web server without exposing each process directly.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Reverse proxy versus forward proxy
A reverse proxy represents your servers to clients. A forward proxy represents clients to outside servers. Apache’s ProxyRequests directive controls forward-proxy behavior, not the reverse-proxy mapping shown above. Leave it disabled:
ProxyRequests OffEnabling forward-proxy mode casually can create an open proxy. Apache’s module reference warns that “Open proxy servers are dangerous both to your network and to the Internet at large.” A reverse-proxy configuration does not require ProxyRequests On.
Choose modules for the backend protocol
mod_proxy supplies the proxy framework, but it does not understand every backend protocol by itself. Load the protocol module that matches the service Apache must reach.
| Backend or topology | Required module family | What it handles |
|---|---|---|
| HTTP or HTTPS-style HTTP backend | mod_proxy plus mod_proxy_http |
Ordinary HTTP requests and responses |
| FastCGI application | mod_proxy plus mod_proxy_fcgi |
FastCGI transport |
| AJP application server | mod_proxy plus mod_proxy_ajp |
AJP transport |
| SCGI application | mod_proxy plus mod_proxy_scgi |
SCGI transport |
| uWSGI application | mod_proxy plus mod_proxy_uwsgi |
uWSGI transport |
| WebSocket endpoint | mod_proxy with the WebSocket upgrade support appropriate to your Apache release; older setups may use mod_proxy_wstunnel |
Connection upgrade and WebSocket traffic |
| Several backend members | mod_proxy_balancer plus one or more balancer-method modules |
Member selection and pooled workers |
Do not load modules merely because they exist. The base proxy module must be combined with the module for the protocol and topology you actually use. A normal HTTP application needs mod_proxy_http; adding a WebSocket, FastCGI, or balancer module does not replace it.
Build a minimal HTTP reverse proxy
The following procedure assumes Apache and an HTTP application are on the same machine, with the application listening on port 8080. Adapt the backend address to your deployment, keeping the scheme and hostname explicit.
1. Confirm the backend contract
Write down the backend protocol, host, port, and public path. For the example, the backend is HTTP at 127.0.0.1:8080, and Apache will publish it at the site root. If the service is intended to occupy only a subpath, decide that before writing directives.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →2. Load the base and protocol modules
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.soModule filenames and loading syntax can vary with the operating system’s Apache packaging, but the required capabilities are the same: the base proxy module and the HTTP protocol module.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
3. Keep forward proxying disabled
ProxyRequests OffThis setting does not prevent Apache from proxying requests to the explicitly configured backend. It prevents clients from choosing arbitrary destinations through Apache.
4. Map the public path with ProxyPass
ProxyPass "/" "http://127.0.0.1:8080/"The first argument is the path clients request from Apache. The second is the backend URL. In this root mapping, a request such as /status is sent to the backend as /status.
5. Add the response-header mapping
ProxyPassReverse "/" "http://127.0.0.1:8080/"This directive lets Apache adjust redirect-related response headers emitted by the backend. Without it, an application that redirects to its own internal hostname or path can send that internal address to the browser.
6. Validate and reload Apache
Use the configuration-test and reload procedure supplied by your operating system or Apache installation. Check the error log while making a request through the public address. A successful request should reach the backend, and a backend redirect should point back to the public Apache address rather than exposing the private listener.
ProxyPass and ProxyPassReverse are not interchangeable
ProxyPass controls the request path. It specifies the mapping from incoming requests to a backend server or a balancer group.
ProxyPassReverse operates on selected response headers. It adjusts Location, Content-Location, and URI values in backend responses so redirects and related URI references continue to work from the public address.
ProxyPassReverse does not search and replace absolute URLs embedded in an HTML response body. If an application emits links such as http://internal.example/ inside its HTML, those links require a separate body-rewriting solution such as mod_proxy_html, or an application-side configuration change. Header rewriting alone will not repair them.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Cookies need their own directives
Some applications set a cookie domain or path that reflects the private backend. Apache provides dedicated directives for those attributes:
ProxyPassReverseCookieDomain internal.example public.example
ProxyPassReverseCookiePath / /app/Use these only when the backend’s cookie attributes actually need translation. The values must describe the internal and public domains or paths in your deployment; they are not a substitute for ProxyPassReverse.
Proxy only an application subpath
If Apache serves the rest of the site locally and only one application belongs behind the proxy, scope the mapping to that path:
ProxyPass "/app/" "http://127.0.0.1:8080/"
ProxyPassReverse "/app/" "http://127.0.0.1:8080/"With this arrangement, a public request for /app/profile is sent to the backend as /profile, while unrelated paths remain available to Apache’s local content handlers.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteKeep trailing slashes consistent
Path prefixes are literal mappings. Inconsistent trailing slashes can produce missing or duplicated path segments, especially when the public prefix and backend target represent directory-like paths. Decide whether both sides end in /, then test requests at the prefix itself and one level below it:
- the exact prefix, such as
/app/; - a child resource, such as
/app/status; - a backend redirect that returns to the public path.
If the backend expects the public prefix to remain in its path rather than be removed, configure the target path accordingly and verify the result from the backend’s access log. Do not rely on visual similarity between two URLs; confirm the path Apache actually sends.
WebSocket proxying and Apache version differences
WebSockets begin with an HTTP request and then upgrade the connection. A normal HTTP proxy mapping is not automatically sufficient for every Apache release or configuration.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
For Apache 2.4.47 and later, the reference documents HTTP upgrade handling with an explicit upgrade=websocket parameter:
Recommended Free Tools
ProxyPass "/some/ws/capable/path/" "http://example.com/some/ws/capable/path/" upgrade=websocketReplace both paths and the backend host with the values for your service. Keep the public and backend path relationship intentional, just as with ordinary HTTP.
WebSocket behavior is version-sensitive. Older Apache releases, or configurations that disable HTTP upgrade handling, may require the guidance and module behavior documented for mod_proxy_wstunnel. Before troubleshooting an application, confirm the Apache version, whether the WebSocket-related module is loaded, and whether the endpoint’s path matches the ProxyPass rule.
Typical WebSocket failure signs
- The initial HTTP request works, but the connection closes during the upgrade.
- The browser reports a failed WebSocket handshake while ordinary pages load.
- Apache logs a missing protocol handler or treats the request as a normal HTTP response.
These symptoms usually point to a protocol-module or version mismatch, an incorrect upgrade mapping, or a backend that is not listening on the address and port in the rule.
Proxying FastCGI, AJP, SCGI, and uWSGI services
The design is the same for non-HTTP application protocols: load mod_proxy and the matching protocol module, then create a mapping whose backend URL uses the protocol and endpoint format that module expects. Do not send a FastCGI service through mod_proxy_http, or assume an AJP or uWSGI listener speaks HTTP simply because it belongs to a web application.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep each mapping’s public path, backend endpoint, and response behavior documented together. If an application redirects, determine whether its protocol module and deployment support the same response-header adjustments as an HTTP backend. If the service also serves browser-facing HTML, remember that header rewriting still does not rewrite absolute links in the body.
Use a balancer when several backends serve one path
For multiple backend instances, define a balancer worker, add its members, and route the public path to the balancer. Apache’s balancing layer uses mod_proxy_balancer and one or more balancer-method modules to decide which member receives each request.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
<Proxy "balancer://app-pool">
BalancerMember "http://127.0.0.1:8080" connectiontimeout=5 timeout=30
BalancerMember "http://127.0.0.1:8081" connectiontimeout=5 timeout=30
</Proxy>
ProxyPass "/app/" "balancer://app-pool/"
ProxyPassReverse "/app/" "balancer://app-pool/"The timeout values in this example are illustrative configuration values, not universal recommendations. Choose them according to application response time, network behavior, and failure policy. Worker settings such as connectiontimeout and timeout determine how long Apache waits while connecting to or communicating with a member.
Keep the balancer’s public mapping paired with ProxyPassReverse when members can issue redirects. When infrastructure changes, review backend DNS reuse and worker timeout behavior; an apparently correct balancer can continue using an old address or fail slowly if those settings do not match the new topology.
Security and exposure checks
Do not let the client choose the target
Use a fixed scheme and hostname in each ProxyPass target. Apache warns that allowing client-controlled values to influence the destination can create a security problem. A rule should map a known public path to a known backend, not construct a destination from a query parameter or request header.
Limit the proxy surface
Proxy only the paths that need it. A path-specific rule reduces accidental exposure of administrative endpoints and makes it clear which service owns each URL. If the entire site belongs to one backend, a root mapping is appropriate; otherwise prefer the narrowest stable prefix.
Separate protocol concerns
Load only the protocol and balancing modules required by the deployment. A WebSocket endpoint, a FastCGI application, and an HTTP API may share Apache, but each mapping should identify the correct backend protocol and path.
Review redirects and cookies as public-interface behavior
Test redirects, cookie domain attributes, cookie path attributes, and links generated by the application. A proxy can successfully return a page while still exposing an internal hostname in a redirect or cookie. Use the dedicated reverse-cookie directives where necessary and fix body links with application settings or an HTML-rewriting module.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Troubleshooting by symptom
| Symptom | Likely cause | What to check |
|---|---|---|
| Apache returns a proxy-handler error or the request is served locally | The base or protocol module is not loaded, or the rule is not in the active configuration. | Confirm mod_proxy and the matching protocol module are loaded, then run the installation’s configuration test and inspect the active virtual-host configuration. |
| Connection refused or a gateway-style failure | The backend is stopped, listening on another address or port, or the URL scheme is wrong. | Check the backend listener, the exact host and port in ProxyPass, and the Apache error log. |
| Requests reach the wrong path or return a backend 404 | The public and backend prefixes do not have the intended relationship, often because of trailing-slash differences. | Test the prefix and a child path; compare the path Apache sends with the backend access log. |
| Redirect exposes an internal hostname | ProxyPassReverse is missing or does not match the request mapping. |
Add a matching reverse rule and verify the backend’s Location, Content-Location, and URI response headers. |
| HTML contains links to the private backend | The links are in the response body, which ProxyPassReverse does not rewrite. |
Change the application’s public URL settings or use a suitable HTML-rewriting configuration such as mod_proxy_html. |
| Login or session cookies work only on one path or host | Cookie domain or path attributes still describe the backend. | Inspect the response’s Set-Cookie attributes and use ProxyPassReverseCookieDomain or ProxyPassReverseCookiePath when appropriate. |
| WebSocket handshake fails while HTTP pages work | Upgrade handling, module selection, Apache version, or the WebSocket path is wrong. | Check the Apache version, the current mod_proxy_wstunnel guidance for older releases, the upgrade parameter where supported, and the backend listener. |
| Requests become slow or fail only after a backend change | Worker timeout values or backend DNS reuse do not match the new infrastructure. | Review connectiontimeout, timeout, member addresses, and the current module reference’s DNS behavior. |
| Unexpected destinations are reachable through Apache | Forward-proxy mode was enabled or a target is influenced by client input. | Set ProxyRequests Off, remove client-controlled target construction, and inspect all proxy directives. |
Choose the configuration shape that matches the deployment
| Decision | Use this shape | Important checks |
|---|---|---|
| One HTTP application owns the whole public site | Root ProxyPass and matching ProxyPassReverse |
HTTP module loaded; redirects use the public host. |
| Apache serves local content plus one application | Path-specific mapping such as /app/ |
Prefix and trailing-slash behavior tested at the exact prefix and child paths. |
| Application speaks FastCGI, AJP, SCGI, or uWSGI | mod_proxy plus the matching protocol module |
Do not use an HTTP handler for a non-HTTP listener. |
| Application maintains WebSocket connections | Version-appropriate upgrade or WebSocket-tunnel configuration | Apache release, module support, upgrade parameter, and endpoint path. |
| Several instances serve one application | A balancer worker with members and a public balancer mapping | Balancer module, member health behavior, selection method, and worker timeouts. |
Operational checklist
- Identify the backend protocol, host, port, and public path before editing Apache.
- Load
mod_proxyand only the protocol or balancer modules required. - Set
ProxyRequests Offfor reverse-proxy operation. - Use explicit backend schemes and hostnames; never derive a target from untrusted client input.
- Pair every request mapping with a matching
ProxyPassReverserule when redirects are possible. - Check cookie domain and path attributes separately.
- Remember that response-header rewriting does not alter absolute URLs in HTML bodies.
- For WebSockets, verify Apache version and upgrade handling before changing application code.
- For balancers, review member selection, connection timeouts, request timeouts, and backend DNS behavior.
- After each change, run the configuration test, reload Apache, exercise the public path, and read both Apache and backend logs.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
