To configure a filesystem-backed WebDAV share in Apache, load mod_dav and mod_dav_fs, create a writable lock-database directory, map a URL to a repository, enable Dav On only there, grant the Apache worker account the required filesystem access, and protect the endpoint with authentication. Then restrict write-capable methods to the users who should be able to create, move, copy, or delete files.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The example below uses Apache’s filesystem provider. It is a configuration shape to adapt to your operating system and package, not a drop-in deployment: module-loading syntax, the service account, password-file directives, TLS setup, and service-management commands vary by platform.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What Apache WebDAV enables
WebDAV extends HTTP with methods that let a remote client work with server-side resources as though they were files. In addition to reading a resource, a client can discover collections, create directories, upload content, move or copy items, and delete them. Enabling WebDAV therefore creates a write surface, not merely a different way to browse a directory.
Apache separates the protocol from the storage provider. mod_dav supplies WebDAV methods, while mod_dav_fs supplies the filesystem provider. With that provider loaded, Dav On is an alias for the default filesystem provider. Keep DAV enabled only on the repository that needs it; enabling it broadly can unintentionally expose unrelated paths to write operations.
#1 Best Overall
- Entry-level NAS Personal Storage：UGREEN NAS DH2300 is your first and best NAS made easy. It is designed for beginners who want a simple, private way to store videos, photos and personal files, which is intuitive for users moving from cloud storage or external drives and move away from scattered date across devices. This entry-level NAS 2-bay perfect for personal entertainment, photo storage, and easy data backup (doesn't support Docker or virtual machines).
- Set Your Devices Free, Expand Your Digital World: This unified storage hub supports massive capacity up to 64TB.*Storage drives not included. Stop Deleting, Start Storing. You can store 22 million 3MB images, or 2 million 30MB songs, or 43K 1.5GB movies or 67 million 1MB documents! UGREEN NAS is a better way to free up storage across all your devices such as phones, computers, tablets and also does automatic backups across devices regardless of the operating system—Window, iOS, Android or macOS.
- The Smarter Long-term Way to Store: Unlike cloud storage with recurring monthly fees, a UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $459.98 for a NAS, while for cloud storage, you need to pay $719.88 per year, $2,159.64 for 3 years, $3,599.40 for 5 years. You will save $6,738.82 over 10 years with UGREEN NAS! *NAS cost based on DH2300 + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Blazing Speed, Minimal Power: Equipped with a high-performance processor, 1GbE port, and 4GB RAM on Board, this NAS handles multiple tasks with ease. File transfers reach up to 125MB/s—a 1GB file takes only 8 seconds. Don't let slow clouds hold you back; they often need over 100 seconds for the same task. The difference is clear.
- Let AI Better Organize Your Memories: UGREEN NAS uses AI to tag faces, locations, texts, and objects—so you can effortlessly find any photo by searching for who or what's in it in seconds. It also automatically finds and deletes similar or duplicate photo, backs up live photos and allows you to share them with your friends or family with just one tap. Everything stays effortlessly organized, powered by intelligent tagging and recognition.
Prerequisites and design decisions
Install or load both DAV modules
Before writing a virtual-host or directory rule, verify that Apache has both modules available and loaded:
mod_davhandles the WebDAV protocol methods.mod_dav_fsconnects those methods to the local filesystem.
Package names and the syntax used to load modules differ between distributions. Use the module-loading mechanism supplied by your Apache package, then validate the configuration before reloading the service. A server with only mod_dav does not have the filesystem provider required by this guide.
Choose a repository and URL
Decide which local directory will hold the content and which URL clients will use. For example, /srv/webdav can be exposed at /webdav. The repository should be dedicated to DAV content rather than mixed with files maintained by unrelated applications.
You can map the URL with an Alias paired with a Directory container, or use a suitable Location arrangement in a virtual host. The correct choice depends on the rest of your site; the important point is that the container matching the repository turns DAV on and carries the authentication and authorization policy.
Plan authentication and write policy
Every DAV-enabled location should require authentication. Apache specifically warns against relying on Basic Authentication by itself. Use Digest Authentication, or use Basic Authentication only when the connection is protected by SSL/TLS. Decide separately who may read or discover resources and who may perform write-capable DAV methods. A single valid-user rule may be too broad for an administrative share.
Create the lock database first
WebDAV locking requires a lock database. Define it globally or in the applicable virtual host with DavLockDB:
Rank #2
- 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
- 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
- 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
- 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
- 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.
DavLockDB "/usr/local/apache2/var/DavLock"The value is a path without a database extension; Apache creates the database files it needs. The parent directory must already exist and be writable by Apache’s configured User and Group. Apache recommends a dedicated directory for this database. Keep it outside the content tree so clients cannot treat lock files as repository content and so ordinary file operations do not mix with lock state.
Set ownership and mode on the parent directory for the account that actually runs the worker processes. A configuration can parse successfully and still fail at runtime if that account cannot create or update the lock database. If you move the lock database, create the new directory and permissions before reloading Apache.
Prepare repository ownership and permissions
The Apache worker account needs to read the repository and write wherever DAV clients are allowed to create, replace, move, copy, or delete resources. Apply the minimum filesystem permissions that satisfy the intended policy. A read-only tree cannot support uploads, and a writable tree outside the expected location can turn a narrow share into a broader compromise.
Files created through DAV are owned by Apache’s configured User and Group. Plan for that ownership when administrators later edit or back up the files. Apache cautions against allowing unrelated FTP or shell processes to modify the repository behind its back: out-of-band changes can bypass the locking model and create confusing ownership or synchronization failures.
Keep the repository separate from the lock-database directory. The content path stores user resources; the lock path stores Apache’s lock state. Grant the service account access to both, but do not expose the lock directory through an Alias or a DAV-enabled URL.
Map the URL and enable the filesystem provider
This example uses an Alias and a matching Directory container:
Rank #3
- 【Reliable External Storage System for Individuals and business】The 3.5 hard drive enclosure supports 2.5/3.5 inches HDD and SSD, max capacity up to 20TB for each hard drive, it's a ideal external hard drive enclosure for personal or enterprise using.Save space on your desktop or laptop.
- 【No heat】The sata enclosure built in Aluminum-Alloy materials and 2 inch Fan.Maximize the security of your data.Fan noise is around 40-50 decibels, not recommended if you are very sensitive to noise.
- 【Up to 5Gbps】This dual bay enclosure equips with advanced chips and USB 3.0 output interface.Transfer 1G files in 3-5 seconds with USB 3.0 Ports, which is 10 times faster than USB 2.0.
- 【Hot Swappable Convenience】The HDD enclosure supports hot swapping, allowing users to replace hard drives without powering off the device. This feature enhances convenience and efficiency in data transfer processes.
- 【Tool-Free Installation】Featuring a tool-free hard drive tray design, the external hard drive enclosure enables easy installation and removal of hard drives without requiring additional tools. Plug and play! No fuss, no muss!
Alias "/webdav" "/srv/webdav"
<Directory "/srv/webdav">
Dav On
# Authentication and authorization directives go here.
</Directory>Dav On activates the default filesystem provider supplied by mod_dav_fs. Place it on the repository container, not in the global server context unless every inherited location is intentionally a DAV share. If your deployment uses a Location container instead, ensure that URL-to-filesystem mapping and the filesystem permissions refer to the same repository.
Do not assume that a URL appearing to be a directory automatically maps to the directory you intended. Check the alias target, trailing-path behavior, virtual-host selection, and any overlapping rules before granting write access.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Add authentication to every DAV-enabled location
A WebDAV client may send methods that are not visible in a simple browser test. Protect the entire DAV container, not just an upload subpath. Digest Authentication is the preferred option in Apache’s guidance; if your environment uses Basic Authentication, require SSL/TLS so credentials are not sent over an unprotected connection.
A filesystem-backed Digest setup has the following shape:
<Directory "/srv/webdav">
Dav On
AuthType Digest
AuthName "WebDAV"
AuthDigestProvider file
AuthUserFile "/etc/apache2/webdav.passwd"
<RequireAny>
Require method GET OPTIONS
Require valid-user
</RequireAny>
</Directory>The password-file location and the utility used to create accounts depend on the operating system’s Apache package. Use a file readable by Apache but not publicly served, and ensure the realm in the credential file matches AuthName. If you choose Basic Authentication over TLS instead, replace the authentication directives with the package’s Basic configuration and enforce HTTPS at the virtual-host level.
The sample policy permits GET and OPTIONS through the method requirement while requiring a valid authenticated user for other methods. That is only a starting policy. For a private share, you may require authentication for discovery and reads as well; for an administrative share, replace the broad valid-user condition with the user or group rule that identifies authorized DAV administrators. Test with the actual client methods you intend to permit.
Rank #4
- High Speed Data Transmission: The D2-320 hard drive enclosure (a DAS, NOT a NAS) adopts USB 3.2 Gen2 protocol for high-speed data transmission up to 10Gbps. With 2 hard drives in RAID 0, the read/write speed can reach up to 521MB/s (SATA III HDD 8TB x 2). With 2 SSD's in RAID 0, the read speed can reach 1075MB/s (SATA III 1TB SSD x 2)
- Multiple RAID Configurations: The D2-320 is a hardware RAID enclosure and it supports RAID 0, RAID 1, JBOD and SINGLE which can better satisfy various demands of users. In RAID 1, data will be in a mirror backup. When there is a damaged hard drive, you can directly replace the hard drive, and the data will be recovered automatically. This provides an absolute security for the data
- Super-Large Storage Capacity: The D2-320 USB storage enclosure can support up to two 3.5" and 2.5" SATA HDD, as well as 2.5" SATA SSD, with a maximum capacity of 22TB per drive, providing users with up to 44TB (22TB x 2) of storage space
- Intelligent Temperature Control: The D2-320 HDD enclosure has an intelligent temperature-controlled and low-noise fan that automatically adjusts its speed based on the temperature of the hard disk. This feature ensures that the hard disk operates at its best temperature and provides better heat dissipation
- Tool-Free Hard Drive Installation: The D2-320 external hard drive enclosure features a tool-free hard drive tray design that allows for easy installation and removal of hard drives without the need for any tools. Furthermore, the D2-320 incorporates a brand new Push-lock unique design from TerraMaster, which automatically locks the hard drive tray when you insert the hard drive, preventing the hard drive from falling out or disconnecting
Authorize read, discovery, and write methods deliberately
WebDAV clients use methods beyond GET. Discovery commonly involves OPTIONS and DAV-specific collection requests; uploads and file management use write-capable methods such as creating, replacing, moving, copying, and deleting resources. Method-level authorization lets you avoid granting every authenticated account the ability to alter the repository.
Read and discovery access
If users should only inspect content, permit the read and discovery methods required by their clients and deny write methods. Verify the client behavior rather than assuming a browser’s successful GET proves that a DAV application will work.
Write access
Require an authenticated account or administrative group for methods that change state. The exact authorization expression depends on your existing Apache authentication provider. Keep the rule inside the DAV container so it applies to the mapped repository and not to unrelated URLs.
Why method tests can be misleading
A rule that allows GET can make the share appear healthy even when the Apache account lacks write permission or the lock database is unwritable. Conversely, a client may issue a method that your policy does not allow even though its user is authenticated. Troubleshoot authentication, method authorization, lock storage, and filesystem permissions as separate layers.
Free tools Windows power users keep installed
One-click scans. No signup required.
Limit XML request size when necessary
Some DAV requests carry XML bodies for operations such as property or lock management. If you need to limit those bodies, use Apache’s LimitXMLRequestBody directive. Apache notes that the ordinary LimitRequestBody directive has no effect on DAV requests. Set a value appropriate to the clients and operations you support, and test property and locking workflows after changing it; an excessively small limit can break legitimate clients.
A complete configuration shape
The following combines the lock database, URL mapping, filesystem provider, Digest authentication, and a basic method policy:
Best Value
- High-Speed Data Transmission: The D4-320 hard drive enclosure (a DAS, NOT a NAS) utilizes the USB 3.2 Gen2 protocol, achieving high-speed data transmission of up to 10Gbps. When equipped with four hard drives, the actual read/write speed can reach up to 1,016 MB/s (combined read/write with four SATA III HDDs of 8TB each). With just one SSD installed, the read speed effortlessly reaches 510 MB/s (SATA III 1TB SSD). The D4-320 supports a single HDD up to 30TB, with a total capacity of 120TB, and is compatible with various hard drives, including 3.5-inch SATA hard drives, 2.5-inch SATA hard drives, and 2.5-inch SATA SSDs
- Plug-and-Play Compatibility: The D4-320 USB storage supports 4 individual disks (NO RAID function), and is plug-and-play, eliminating the need for drivers. It is highly compatible with MAC, Windows, and Linux operating systems. The USB Type-C interface supports various computer interfaces, including USB 3.0, USB 3.1, USB 3.2, Thunderbolt 3, and Thunderbolt 4
- Hot Swappable Convenience: The D4-320 HDD enclosure supports hot swapping, allowing users to replace hard disks without powering off the device. This feature enhances convenience and efficiency in data transfer processes
- Tool-Free Hard Drive Management: Featuring a tool-free hard drive tray design, the D4-320 external HDD enclosure enables easy installation and removal of hard drives without requiring additional tools. Furthermore, the D4-320 incorporates TerraMaster's unique Push-lock design, automatically securing the hard drive tray upon insertion, preventing the hard drive from falling out or disconnecting
- Efficient Heat Dissipation and Quieter Operation: The D4-320 direct attached storage incorporates an intelligent temperature-controlled fan for optimal heat dissipation. Additionally, specialized sound-absorbing panels and vibration damping measures contribute to a quieter operation, with noise levels reduced by up to 50% compared to the previous generation. In standby mode, the noise level drops below 21 dB(A), creating a remarkably quiet user environment
DavLockDB "/usr/local/apache2/var/DavLock"
Alias "/webdav" "/srv/webdav"
<Directory "/srv/webdav">
Dav On
AuthType Digest
AuthName "WebDAV"
AuthDigestProvider file
AuthUserFile "/etc/apache2/webdav.passwd"
<RequireAny>
Require method GET OPTIONS
Require valid-user
</RequireAny>
# Add a LimitXMLRequestBody value here if XML-body limits are required.
</Directory>Adapt the module-loading lines, credential-file directives, service account, and TLS configuration to your platform. The essential source-backed requirements are a DAV provider, a lock database whose parent Apache can write, repository permissions that match the operations you authorize, and authentication on the DAV location.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Deployment choices and their trade-offs
| Decision | Option | What it changes |
|---|---|---|
| Storage provider | Filesystem provider with mod_dav_fs |
Stores resources in the local repository and uses normal filesystem ownership and permissions. |
| Storage provider | Another DAV backend | Uses a different provider’s storage and operational rules; the filesystem-specific permission steps in this guide do not automatically apply. |
| Authentication | Digest Authentication | Apache’s recommended alternative to sending Basic credentials without transport protection; configure a compatible Digest password file. |
| Authentication | Basic over SSL/TLS | Can be used when the entire connection is protected by TLS; never treat unencrypted Basic Authentication as sufficient protection. |
| URL mapping | Alias plus Directory |
Clearly separates the public URL from the local repository path and places Dav On on the filesystem container. |
| URL mapping | Location arrangement |
Can fit a virtual-host design, but must still map to the intended repository and carry the same authentication and authorization policy. |
| Repository topology | Single shared repository | Simpler administration, but method and filesystem permissions must prevent users from changing content they should only read. |
| Repository topology | Per-user repositories | Provides stronger separation between users, at the cost of more mappings, ownership management, and lock-database administration. |
Apache’s module documentation establishes the filesystem-provider path and its security requirements but does not prescribe one universal topology. Choose the arrangement that matches your user groups, backup process, and administrative boundaries.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteValidate the deployment before handing it to users
- Check module availability. Confirm that both
mod_davandmod_dav_fsare loaded by the package configuration. - Create the lock parent. Make the directory named by the directory component of
DavLockDB, keep it outside the content tree, and grant Apache’s configuredUserandGroupthe required write access. - Check the repository. Confirm that the same worker account can read existing resources and write only where your policy allows changes.
- Validate Apache syntax. Run the configuration-test command supplied by your platform before reloading or restarting the service.
- Test unauthenticated access. Requests to the DAV URL should not expose the repository when no credentials are supplied.
- Test an authorized read. Verify listing or retrieval with a supported client and confirm that discovery methods required by that client are allowed.
- Test an authorized write. Create a temporary directory, upload a file, move or copy it, and delete it. Confirm that the resulting ownership is the Apache service account as expected.
- Test a restricted account. Ensure a user who should be read-only cannot perform the write methods covered by your authorization policy.
- Inspect logs for failures. Distinguish authentication denials, method denials, filesystem errors, and lock-database errors rather than treating every failure as a generic WebDAV problem.
Troubleshoot the common failure modes
Clients can read but cannot upload
- Check write permission on the repository and every parent directory needed to reach it.
- Check that the Apache worker account, not your interactive shell account, owns or can write the target path.
- Check that the requested method is allowed by the DAV authorization rule.
- Check the lock-database parent for write permission; a read-only test can succeed even when locking fails.
Apache reports a lock or database error
- Verify that the
DavLockDBparent exists and is writable by Apache. - Confirm that the configured path is not inside a client-visible content tree.
- After moving the database, remove stale configuration references and reload only after the new directory has the correct ownership and mode.
Authentication succeeds but DAV operations are denied
- Inspect the method used by the client and compare it with the
Require methodrules. - Check whether the rule intentionally requires an administrator or group rather than any valid user.
- Confirm that authentication directives are attached to the same
DirectoryorLocationthat actually handles the mapped URL.
Files have unexpected owners or later edits fail
That behavior is normal when DAV creates files: Apache’s configured User and Group become the owners. Align administrative editing, backup, and deployment processes with that ownership, or adjust controlled group permissions. Do not let unrelated FTP or shell jobs rewrite the repository without accounting for WebDAV locks.
XML operations fail after adding a request limit
Recheck the value of LimitXMLRequestBody. The normal LimitRequestBody setting does not control DAV XML requests, and a limit that is too low can reject otherwise valid property or lock operations.
Operate and secure the share over time
- Review every URL where
Dav Onis inherited or explicitly configured; remove accidental DAV enablement from locations that do not need writes. - Keep authentication mandatory after virtual-host, alias, or directory changes.
- Audit which accounts can perform write methods and reduce broad
valid-userrules when a smaller administrator group is appropriate. - Back up repository content and document the lock-database location and ownership. The lock database is operational state, not user content; preserve a consistent procedure for restoring it with Apache stopped or otherwise quiesced according to your service process.
- Monitor ownership and permissions of newly created files so an upload cannot silently create content that administrators cannot manage.
- Use TLS whenever credentials or repository data cross an untrusted network, including when Basic Authentication is selected.
A secure Apache WebDAV deployment is the combination of protocol modules, a writable and isolated lock database, correctly permissioned content, authenticated access, and method-level authorization. Omitting any one of those layers produces a share that may appear to work in a browser while failing under real client operations or exposing more write access than intended.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
