WebBuilding

Software and platforms

Apache HTTP Server

Summary

The Apache HTTP Server, often called Apache or httpd, is free, open-source web server software maintained by the Apache Software Foundation. A group of webmasters started it in February 1995 by pooling fixes for the NCSA web server, released version 1.0 on December 1, 1995, and passed NCSA as the most used server in 1996. As of October 21, 2026, W3Techs finds it on 21.4% of websites whose web server is known.

Web Building Encyclopedia · Software and platforms · Last reviewed October 22, 2026 · 7 min read

What the Apache HTTP Server is

The Apache HTTP Server is free, open-source web server software: the program that waits for requests from browsers and sends back pages and files using HTTP. Its project page calls it an “extensible open-source web server for modern operating systems.”1 People often shorten the name to Apache, and the project calls the program httpd.1 The NCSA server that Apache grew out of went by the same name: the project’s history calls it the NCSA HTTP daemon, or httpd.2

Apache is built from modules, separate pieces of code that each add a feature, such as compression, HTTP/2 or certificate handling.3 Even the part that accepts connections and hands them to processes or threads is a module, called a Multi-Processing Module or MPM.4

Version 2.4 ships modules for many jobs, including modules for HTTP/2 (mod_http2), for passing requests to a separate application server over the FastCGI protocol (mod_proxy_fcgi) and for obtaining security certificates automatically (mod_md).3

Apache is a project of the Apache Software Foundation (ASF).1 As of October 21, 2026, W3Techs finds it on 21.4% of websites whose web server it can identify, third behind Cloudflare Server (32.5%) and Nginx (30.3%).5

Origins: from NCSA httpd to Apache 1.0 (1995)

In February 1995 the most popular web server was the public domain HTTP daemon written by Rob McCool at the National Center for Supercomputing Applications (NCSA) at the University of Illinois, Urbana-Champaign. Its development had stalled after McCool left NCSA in mid-1994, and many webmasters were passing around their own fixes and extensions.2

A small group of those webmasters agreed to pool their changes, which were shared as patches. Brian Behlendorf and Cliff Skolnick set up a mailing list and a shared machine in the California Bay Area, with bandwidth donated by HotWired. By the end of February 1995, eight core contributors formed the Apache Group: Brian Behlendorf, Roy T. Fielding, Rob Hartill, David Robinson, Cliff Skolnick, Randy Terbush, Robert S. Thau and Andrew Wilson. Eric Hagberg, Frank Peters and Nicolas Pioch made additional contributions.2

Starting from NCSA httpd 1.3, the group added the published bug fixes and improvements it could find and tested the result on its own servers. The first public release, version 0.6.2, came out in April 1995.2 NCSA had restarted work on its own server at about the same time, and two of its developers, Brandon Long and Beth Frank, joined the Apache list in March as honorary members so the two projects could share fixes.2 After beta testing, new documentation by David Robinson and a set of standard modules, Apache 1.0 was released on December 1, 1995.2

The ASF credits Behlendorf with first using the name for the server. It says a pun on the name quickly spread in the community: the rumor that Apache stood for “a patchy server,” because the code grew out of patches to NCSA’s server. According to the ASF, the name shows appreciation for the people and tribes who call themselves Apache.6

Apache overtook NCSA httpd quickly. According to the project’s own history, less than a year after the group formed it passed NCSA’s server as the most used on the internet in the Netcraft Web Server Survey of 1996.2

The Apache Software Foundation and the license

In June 1999 members of the Apache Group formed the Apache Software Foundation, incorporated as a 501(c)(3) nonprofit corporation in the United States.7 Its purpose was to give the server organizational, legal and financial support. The foundation later took in many other open-source projects.2

All software produced by the ASF and its projects is released under the Apache License.8 The ASF approved version 1.1 of the Apache License in 2000.8 The current version, the Apache License 2.0, is dated January 2004.9

The foundation has also reconsidered its use of Indigenous imagery. In July 2024 the ASF said it would retire its feather logo, stating that “it is inappropriate for the Foundation to use Indigenous themes or language.” It kept its legal name for now, citing the cost and work a change would involve.10 A new logo built around an oak leaf was introduced on September 11, 2025.11

Versions 2.0 to 2.4

Apache 2.0.35 was announced on April 5, 2002, as released for general availability, meaning a finished release rather than a test version. The announcement listed several ways of running the server, including threaded and hybrid process and thread models, higher performance than Apache 1.3, built-in SSL and WebDAV support, better proxying and a new system of filters.12

Version 2.4 was announced on February 21, 2012, on the server’s 17th anniversary. The ASF promised lower resource use, better concurrency and less memory use, with performance “on par, or better, than pure event-driven Web servers.”13 In 2.4 the event MPM, described below, stopped being experimental and became fully supported.3 The project’s notes add that despite its many new features, 2.4 tends to use less memory than 2.2.3

The 2.4 branch has kept adding features through point releases. HTTP/2 support arrived with mod_http2 in 2.4.17, and mod_md, which obtains certificates automatically through the ACME protocol, arrived in 2.4.30.3 Running a server with TLS 1.3 and OpenSSL 1.1.1 requires 2.4.43 or newer.1

Older branches are closed. Apache 2.2 is end of life: its final release was 2.2.34 in July 2017, and it gets no further patches or security updates.1 As of October 22, 2026, the newest version is 2.4.69, released on October 1, 2026.1

Security record

The project lists fixed vulnerabilities, with severity ratings, on its security pages. In October 2021 it disclosed a flaw that attackers were already using. A change to path handling in 2.4.49 let attackers reach files outside the folders a site meant to share, when those files lacked the usual default protection, and, where CGI scripts were also enabled, could let them run their own code. The project rated it critical and confirmed it was exploited in the wild.14

Version 2.4.50 fixed that flaw on October 4, 2021. The fix turned out to be incomplete, and 2.4.51 closed the gap on October 7, 2021.14 The October 2026 release, 2.4.69, fixed 20 more issues, five rated moderate and the rest low.14

How Apache handles requests

An MPM decides how Apache uses the computer’s processes and threads. A process is a running copy of a program, and a thread is a lighter line of work inside a process. Only one MPM can be loaded at a time.4 There are three main choices on Unix-like systems:

  • prefork uses separate processes and no threads. It is the fallback when a system does not support threads.4
  • worker is a hybrid: several processes, each running a fixed number of threads, with a listener thread that hands new connections to them.15
  • event builds on worker. When a thread finishes a response, it passes the idle connection back to the listener thread, so threads are not tied up waiting on visitors who have stopped sending requests.15

Apache picks event by default on systems that support threads and thread-safe polling, and the documentation says all modern operating systems support both, so in practice the default is almost always event.4

One Apache server can run many websites. The documentation calls this virtual hosting: running more than one website on a single machine. IP-based virtual hosts give each site its own IP address, while name-based virtual hosts put many site names on each address.16 Name-based hosting works because HTTP/1.1 requires every request to name the site it is for in a Host header, so the server can tell which site a visitor wants.17

Apache also allows .htaccess files, which the documentation calls “distributed configuration files.” They let a site change settings folder by folder without access to the main configuration.18 The convenience has a cost: when .htaccess files are allowed, Apache checks for them in every folder on the path, on every request, even if none exist.18 The documentation advises putting settings in the main configuration file whenever you have access to it.18

This feature matters for content management systems. WordPress, for example, writes rules into .htaccess so that Apache can serve its pretty permalinks, the readable page addresses WordPress can use.19 Those rules call mod_rewrite, the Apache module that changes incoming addresses using pattern-matching rules called regular expressions, so that any public address can be mapped onto the site’s internal structure.1920

Apache’s share of the web

When it released version 2.4 in 2012, the ASF said Apache had been the most popular web server on the internet since April 1996, and cited Netcraft for a record of nearly 400 million websites.13

Its share is smaller today. As of October 21, 2026, W3Techs puts Apache at 21.4% of websites with a known web server, behind Cloudflare Server at 32.5% and Nginx at 30.3%.5 Almost all of those sites run version 2: W3Techs counts version 1 on 0.2% of Apache sites as of October 22, 2026. Its list of popular sites using Apache includes Adobe.com, Samsung.com and Mit.edu, with several entries marked as using Apache only on a subdomain.21 W3Techs notes that one website may use more than one web server.5

Apache’s configuration style also carries over to another server. LiteSpeed, at 13.9% in the same W3Techs survey, describes itself as a drop-in replacement for Apache that reads Apache configuration files and supports .htaccess.522

Timeline

  1. Apache httpd 2.4.69 is released with 20 security fixes14
  2. The ASF introduces a new oak leaf logo11
  3. The ASF says it will retire its feather logo10
  4. Version 2.4.50 fixes an actively exploited path traversal flaw in 2.4.4914
  5. Apache 2.2.34, the final 2.2 release, comes out1
  6. Apache HTTP Server 2.4 is announced on the project’s 17th anniversary13
  7. The Apache License 2.0 is published9
  8. Apache 2.0.35 is released for general availability12
  9. The ASF approves version 1.1 of the Apache License8
  10. Members of the Apache Group form the Apache Software Foundation7
  11. Apache becomes the most popular web server, according to the ASF13
  12. Apache 1.0 is released2
  13. Version 0.6.2, the first public release, comes out2
  14. Eight webmasters form the Apache Group to pool fixes for NCSA httpd2

What it means for your website

If you use a hosted builder such as Squarespace or Wix, the platform runs its own servers and Apache is not your concern. If you run self-hosted WordPress on shared web hosting, your host may run Apache or an Apache-compatible server such as LiteSpeed. Your host can tell you which.

  • Treat .htaccess with care. WordPress edits it to handle pretty permalinks, and the WordPress handbook explains how to restore the file if a misbehaving plugin damages it.19 One typing mistake can take a site offline, so keep a copy before editing and keep regular website backups.
  • Know that .htaccess is not universal. It works on Apache and on LiteSpeed, which supports .htaccess.22 Nginx has no equivalent, so its rules have to go into the server configuration, set by an administrator.23 Plan for that if you move between hosts.
  • Ask which version your host runs. The current branch is 2.4, and the newest release as of October 22, 2026 is 2.4.69. Apache 2.2 has had no security updates since its final release in July 2017.1
  • Patch quickly if you manage the server. The 2021 path traversal flaw was exploited in the wild, and the fix came out within days.14 On a virtual private server you install those updates yourself. On managed hosting, the host should.

Which web server a host uses is one of the questions worth asking before you sign up. Our guide to domains and hosting covers the others.

See also

References

  1. Apache HTTP Server Project. The Apache Software Foundation. 2026-10-01. accessed October 22, 2026.
  2. About the Apache HTTP Server Project. The Apache Software Foundation. accessed October 22, 2026.
  3. Overview of new features in Apache HTTP Server 2.4. Apache HTTP Server Version 2.4 Documentation, The Apache Software Foundation. accessed October 22, 2026.
  4. Multi-Processing Modules (MPMs). Apache HTTP Server Version 2.4 Documentation, The Apache Software Foundation. accessed October 22, 2026.
  5. Usage statistics of web servers. W3Techs. 2026-10-21. accessed October 22, 2026.
  6. The Apache name. The Apache Software Foundation. accessed October 22, 2026.
  7. History timeline. The Apache Software Foundation. accessed October 22, 2026.
  8. Licenses. The Apache Software Foundation. accessed October 22, 2026.
  9. Apache License, Version 2.0. The Apache Software Foundation. 2004-01. accessed October 22, 2026.
  10. Evolving the ASF Brand. The Apache Software Foundation. 2024-07-18. accessed October 22, 2026.
  11. Introducing The ASF’s New Logo. The Apache Software Foundation. 2025-09-11. accessed October 22, 2026.
  12. Apache 2.0.35 released for General Availability. Greg Stein, Apache HTTP Server developers' mailing list, as reproduced by LWN.net. 2002-04-05. accessed October 22, 2026.
  13. The Apache Software Foundation Celebrates the 17th Anniversary of the Apache HTTP Server with the release of v2.4. The Apache Software Foundation. 2012-02-21. accessed October 22, 2026.
  14. Apache HTTP Server 2.4 vulnerabilities. The Apache Software Foundation. accessed October 22, 2026.
  15. Apache MPM event. Apache HTTP Server Version 2.4 Documentation, The Apache Software Foundation. accessed October 22, 2026.
  16. Apache Virtual Host documentation. Apache HTTP Server Version 2.4 Documentation, The Apache Software Foundation. accessed October 22, 2026.
  17. RFC 2068: Hypertext Transfer Protocol, HTTP/1.1. Internet Engineering Task Force, RFC Editor. 1997-01. accessed October 22, 2026.
  18. Apache HTTP Server Tutorial: .htaccess files. Apache HTTP Server Version 2.4 Documentation, The Apache Software Foundation. accessed October 22, 2026.
  19. Apache HTTPD / .htaccess. Advanced Administration Handbook, WordPress.org. accessed October 22, 2026.
  20. Apache mod_rewrite. Apache HTTP Server Version 2.4 Documentation, The Apache Software Foundation. accessed October 22, 2026.
  21. Usage statistics and market share of Apache. W3Techs. 2026-10-22. accessed October 22, 2026.
  22. LiteSpeed Web Server. LiteSpeed Technologies. accessed October 22, 2026.
  23. Nginx. Advanced Administration Handbook, WordPress.org. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].