Enable Apache response compression by loading mod_deflate and adding a MIME-scoped output filter such as AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript. Put the directive in the server configuration, a virtual host, a directory container, or an allowed .htaccess file. Apache negotiates gzip with browsers; it does not use the separate deflate content encoding through this module.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What mod_deflate does
mod_deflate is Apache HTTP Server’s response-compression module. It provides the DEFLATE output filter, which compresses a response after the application or static-file handler has produced it and before Apache sends the bytes over the network. The browser advertises compression support with the Accept-Encoding request header; Apache then selects a compatible content encoding.
As an Amazon Associate I earn from qualifying purchases.
Despite the module name, browser-compatible output is normally sent with Content-Encoding: gzip. Apache’s documentation states that the module supports gzip for this purpose; the separate HTTP deflate content encoding is not supported by this module. A client that does not advertise gzip receives an uncompressed response.
Compression is useful for text because HTML, CSS, JavaScript, XML, and plain text contain repeated patterns. It is usually wasteful for formats that are already compressed, such as JPEG, GIF, and PNG. There is no universal compression-ratio or speed figure: the result depends on the response’s content, size, compression settings, network, CPU, and cache behavior.
#1 Best Overall
Choose where to configure the filter
Use the most central configuration you control. A server or virtual-host configuration is easier to audit and avoids repeating rules in every directory. A directory container is useful when one part of a site needs a different policy. An .htaccess file works only when the hosting provider permits the relevant directives for that directory.
| Configuration location | Typical use | Important consideration |
|---|---|---|
| Global server configuration | One policy for many virtual hosts | Requires administrator access; verify that the policy is appropriate for every site. |
<VirtualHost> |
Separate compression policy per domain | Usually the clearest choice on a server hosting multiple sites. |
<Directory> |
Apply a policy to a filesystem directory | Apache’s documentation demonstrates this context for a text-only filter. |
.htaccess |
Per-site or per-directory hosting without main-config access | The host must allow the filter directives; otherwise Apache returns a 500 error or ignores the file according to its configuration. |
Make one change in the narrowest suitable context first. If you manage several virtual hosts, avoid putting a broad rule in the global configuration until you have checked that it will not affect downloads, APIs, or pre-compressed assets.
Free tools Windows power users keep installed
One-click scans. No signup required.
Broad filtering versus MIME-type scoping
Apache documents two practical patterns. SetOutputFilter DEFLATE attaches the filter broadly to output in its container. AddOutputFilterByType DEFLATE ... attaches it only when the response’s MIME type matches one of the listed values.
| Approach | Configuration | Best for | Risk |
|---|---|---|---|
| Broad filter | SetOutputFilter DEFLATE |
Environments where every generated response is known to be suitable for compression | Can spend CPU on binary or already-compressed data and may affect responses you did not intend to compress. |
| MIME-scoped filter | AddOutputFilterByType DEFLATE ... |
Most websites that want to compress text while leaving media and archives alone | Responses with an unlisted or incorrect MIME type will not be compressed. |
MIME scoping is the safer default because it makes the intended content explicit. The response must actually be labeled with one of the listed types; a JavaScript file served as an unexpected binary type will not match until its server-side MIME configuration is corrected.
Prepare before editing Apache
- Identify whether you administer the main Apache configuration, a virtual host, a directory block, or only
.htaccess. - Record the current configuration and make a reversible backup before changing it.
- Confirm that the installation includes
mod_deflate. A directive that is unavailable on the server will produce a configuration error rather than silently enabling compression. - Choose the MIME types your application actually returns. Start with HTML, plain text, XML, CSS, and JavaScript.
- List files that are already compressed, including common image formats, archives, and packaged assets, so they can be excluded from a broad policy.
- Plan a test through the same hostname, proxy, and cache path that real visitors use. Testing the origin alone can hide intermediary behavior.
After editing the main configuration, run the Apache configuration validator supplied by your operating system before reloading the service. A syntax error should be fixed before a reload is attempted. With .htaccess, the first request is the practical test, so keep a way to remove the change if Apache returns an internal-server-error response.
Method 1: enable the filter broadly
Place this directive in the applicable server, virtual-host, directory, or permitted .htaccess context:
SetOutputFilter DEFLATEThis tells Apache to pass output through the DEFLATE filter in that container. It is intentionally broad: the directive does not list HTML, CSS, or JavaScript individually. Use it only when the responses covered by the container are known to be suitable, or pair it with explicit exclusions for content that should not be compressed.
A broad rule can also affect error pages, API responses, downloads, and unusual MIME types. Review those responses rather than assuming that a rule working for the home page is safe for the entire virtual host.
Method 2: compress selected text MIME types
For most sites, use a MIME-scoped rule:
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascriptThis enables the filter only for the listed response types. The list covers the formats shown in Apache’s 2.4 documentation examples. Add another type only when you have verified that your application sends that type as textual, compressible content. Do not add a type merely because a filename ends in a familiar extension; Apache matches the response’s MIME metadata.
Apache also documents a directory-scoped example that limits compression to HTML:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →<Directory "/var/www/html">
AddOutputFilterByType DEFLATE text/html
</Directory>Replace the directory path with the real document root and put the block where Apache permits directory containers. A virtual-host rule is generally preferable when the policy should follow a domain rather than a filesystem path.
Using the same rules in .htaccess
If your host allows these directives in .htaccess, place the MIME-scoped rule in the document root or in the directory whose responses should be compressed:
Rank #3
- Used Book in Good Condition
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascriptKeep the file free of unrelated rewrites while testing. If the request immediately returns HTTP 500, remove the new line and ask the server administrator which override class is allowed; a customer-level account cannot enable a directive that the main configuration has prohibited.
A broad per-directory rule is syntactically simple but has the same risks as the server-level version:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsSetOutputFilter DEFLATEUse MIME scoping unless you have a specific reason to filter every response in that directory.
Exclude already-compressed images and other unsuitable output
Apache’s documentation shows an environment-variable exclusion for common image formats:
SetEnvIfNoCase Request_URI "\.(?:gif|jpe?g|png)$" no-gzipThe no-gzip flag tells the compression module not to gzip matching requests. The pattern is case-insensitive and checks the request URI, so it covers uppercase and lowercase extensions. Extend the exclusion policy for other formats that are already compressed or for downloads where additional CPU work provides no useful reduction, but verify each extension and response type in your application.
Do not use an exclusion as a substitute for correct MIME scoping. A response can have a non-image URL and still be a binary archive, while a dynamically generated text response may have no conventional filename extension.
How browser negotiation and caching work
The request and response headers
A browser that supports gzip normally sends an Accept-Encoding request header containing gzip. When Apache compresses the response, it should identify the representation with Content-Encoding: gzip. A client that does not advertise a supported encoding receives the uncompressed representation.
Compression changes the representation selected for a URL. Caches and proxies therefore need to know that the response varies according to Accept-Encoding. Check that Apache or the surrounding stack supplies Vary: Accept-Encoding and that intermediaries preserve it. Without correct variation metadata, a cache can serve a gzip response to a client that did not request it, or serve an uncompressed response when a compressed one was available.
Direct origin and intermediary deployments
| Deployment | What to verify |
|---|---|
| Browser connects directly to Apache | Check negotiation, Content-Encoding, and Vary at the Apache response. |
| Apache sits behind a reverse proxy | Verify which layer compresses, whether the proxy forwards Accept-Encoding, and whether Apache’s response headers survive the hop. |
| A shared cache serves the site | Confirm that the cache keys or varies on Accept-Encoding; purge an old object after changing the policy. |
| Several layers can compress | Ensure only the intended layer performs compression. Double compression can corrupt responses or produce an unexpected content encoding. |
Test through the public endpoint, not just the backend address. A proxy may decompress, recompress, or replace headers even when Apache is configured correctly.
Security: do not compress secrets blindly
Apache warns that some web applications are vulnerable to information disclosure when TLS carries deflate-compressed data. The concern is that an attacker who can influence part of a response and observe compressed lengths may infer a secret value embedded in the same response; this family of attacks is commonly associated with BREACH.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallReview pages that combine confidential tokens with attacker-controlled text, especially under HTTPS. Options include leaving compression disabled for those responses, separating secrets from reflected input, changing the response design, and applying the application’s documented mitigation. A single global compression switch cannot determine which dynamic pages are safe.
The warning is about response compression over TLS, not a claim that every compressed page is vulnerable. Treat it as an application-level decision: identify sensitive response patterns and scope or disable compression where necessary.
Best Value
Do not confuse response compression with input decompression
The ordinary configuration above compresses output sent from Apache to clients. Apache documentation also discusses decompressing compressed request bodies and inflating output for special proxy or WebDAV cases. Those are separate behaviors with different security and resource implications.
Do not enable input decompression or output-inflation settings merely because you want gzip responses. Configure those features only when a specific proxy, WebDAV workflow, or application protocol requires them, and document the reason and limits.
Verify that compression is really active
Use a response that should match your MIME rule, such as an HTML page or JavaScript asset, and test both negotiation paths.
- Request the resource while advertising gzip, for example with an HTTP client that sends
Accept-Encoding: gzip. - Inspect the response headers. A compressed response should show
Content-Encoding: gzip; it should also carry the appropriateVary: Accept-Encodingmetadata when caches are involved. - Request the same URL without an
Accept-Encodingheader. The response should be readable by a client that does not support gzip and should not claim a gzip content encoding. - Check the response’s
Content-Type. If it is not one of the types in your MIME-scoped rule, the absence of compression may be expected. - Test a JPEG, GIF, or PNG and confirm that your exclusion or MIME policy leaves it uncompressed.
- Repeat the checks through the public proxy or cache path and after a cache purge, because an intermediary may serve an older representation.
Do not infer success from a smaller transfer shown in a browser waterfall alone. Browser developer tools can display decoded sizes, cached responses, or intermediary transformations; headers provide the decisive evidence.
Troubleshooting branches
No Content-Encoding: gzip on HTML or JavaScript
- Confirm that the response’s
Content-Typeexactly matches one of the configured MIME values. - Check that
mod_deflateis installed and loaded in the Apache instance serving the request. - Make sure the rule is in a context that applies to the request and is not overridden by a more specific configuration.
- Send an
Accept-Encoding: gzipheader in the test request; Apache will not compress for a client that does not advertise a supported encoding. - Inspect proxy and cache behavior. The origin may compress while the public layer removes or replaces the header.
Apache returns HTTP 500 after editing .htaccess
- Remove the new directive to restore service.
- Ask the administrator whether output-filter directives are allowed in that directory’s override settings.
- Check the Apache error log for the exact directive or module reported as invalid.
- Move the rule to the virtual-host or server configuration if you control it, where module availability and syntax can be validated before reload.
Images or downloads are still being compressed
- Replace a broad
SetOutputFilter DEFLATErule withAddOutputFilterByTypeand the intended text types. - Verify the actual
Content-Type; an incorrectly labeled binary response can match a text rule. - Add a documented
no-gzipexclusion for known pre-compressed paths or extensions. - Retest through the cache after purging an object created under the old policy.
Clients report corrupted or unreadable responses
- Look for two layers applying compression. Disable one layer and test again.
- Check that
Content-Encodingaccurately describes the bytes delivered. - Verify that a cache is not serving a gzip representation to a client that did not advertise gzip.
Performance expectations and trade-offs
Compression trades CPU time for fewer bytes on the wire. Text-heavy pages on slower links often benefit, while tiny responses may save too little to justify processing. Already-compressed media normally gains little and can cost CPU. The correct policy depends on response mix, server capacity, latency, and cache hit rate; Apache does not publish one compression ratio that applies to every site.
Measure representative responses after enabling the rule. Compare transfer sizes and response times for HTML, CSS, JavaScript, API text, and excluded media, and watch CPU utilization during peak traffic. Keep the measurement conditions—client, proxy path, cache state, and response version—consistent so that the comparison is meaningful.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →A practical decision checklist
- Use MIME scoping unless you have a documented reason to filter every response.
- Enable the rule in the highest-level context you control that matches the intended site or directory.
- Include the documented text types:
text/html,text/plain,text/xml,text/css,text/javascript, andapplication/javascript. - Exclude GIF, JPEG, PNG, and other formats that are already compressed or should not be filtered.
- Confirm gzip negotiation with request and response headers, not only visual page loading.
- Preserve
Vary: Accept-Encodingthrough reverse proxies and caches. - Review HTTPS responses that mix secrets with attacker-controlled input before enabling compression globally.
- Keep input decompression and output inflation disabled unless a separate proxy or WebDAV requirement calls for them.
- Retest after configuration reloads, cache purges, application changes, and proxy changes.
The safest general starting point is the MIME-scoped AddOutputFilterByType DEFLATE rule in the appropriate Apache context, followed by header checks through the real delivery path. Broaden the policy only after you have accounted for binary content, intermediary caching, and sensitive TLS responses.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
