The safest default is to let Apache HTTP Server listen on public port 80 and reverse-proxy requests to Tomcat on a local connector such as port 8080. Tomcat remains on an unprivileged backend port, while Apache owns the public address and can later terminate TLS. Configure Tomcat with the public host and port so redirects and absolute links do not reveal :8080.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
You can make Tomcat bind to port 80 directly, but on Unix-like systems that requires a privilege mechanism and couples the application server to a privileged socket. AJP is another option for established Apache/Tomcat deployments, although it is clear text and should stay on a trusted network with the required secret.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Apache Tomcat 7 | $40.00 | Buy on Amazon |
| 2 |
|
Apache: The Definitive Guide (3rd Edition) | $26.20 | Buy on Amazon |
| 3 |
|
Professional Apache Tomcat | $9.46 | Buy on Amazon |
| 4 |
|
Apache Tomcat 7 Essentials | $39.99 | Buy on Amazon |
| 5 |
|
Tomcat: The Definitive Guide | $28.00 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
How the port-80 layout works
A browser connects to http://www.example.com, which means TCP port 80 unless another port is written in the URL. Apache accepts that connection, selects the virtual host and application path, and forwards the request over a private connection to Tomcat. Tomcat can continue listening on 127.0.0.1:8080 or another protected interface.
- The client resolves the public hostname and opens a connection to the edge server on port 80.
- Apache receives the request and matches a rule such as
/myapp. - The reverse proxy sends the request to Tomcat at
http://127.0.0.1:8080/myapp. - Tomcat returns the response; Apache sends it back to the client and rewrites backend redirects when necessary.
Only one server application can listen on a particular IP address and TCP port at a time. If another process already owns port 80, Apache cannot start there until that conflict is resolved or a different address is used.
#1 Best Overall
Which exposure method should you use?
| Method | Privilege requirement | Isolation and backend exposure | TLS and URL handling | When it fits |
|---|---|---|---|---|
| Apache HTTP reverse proxy to Tomcat HTTP | Apache needs the public listener; Tomcat can stay unprivileged on 8080. | Tomcat can bind to loopback or a firewall-protected interface. | Apache can terminate TLS; proxyName and proxyPort make generated URLs public. |
The clearest default for a new or same-host deployment. |
| Tomcat HTTP Connector directly on 80 | On Unix-like systems, binding below 1024 needs an operating-system capability, privilege, or service arrangement. | Fewer network hops, but Tomcat itself owns the privileged public socket. | TLS and edge policy must be handled by Tomcat or another separate component. | A deliberately simple topology where the privilege coupling is acceptable. |
Apache mod_proxy_ajp to Tomcat |
Apache owns port 80; Tomcat uses its AJP connector. | AJP is clear text, so keep it on a trusted network and restrict reachability. | Apache still handles the public endpoint; AJP-specific secret and version settings are required. | An existing Apache/Tomcat architecture that already depends on AJP. |
For most deployments, HTTP reverse proxying is easier to inspect, secure, and troubleshoot than introducing AJP. Direct binding is not inherently faster in a way this configuration guide can quantify; its main distinction is operational coupling, not a documented performance guarantee.
Plan the deployment before changing configuration
Identify the context path
Decide whether the application is reached as /myapp or at the site root. A WAR named myapp.war commonly produces a /myapp context, but the deployed context configuration is authoritative. The path in Apache’s ProxyPass rule must match the path users request.
Choose the backend address
On the same host, bind Tomcat’s HTTP connector to loopback when feasible. That prevents unrelated machines from connecting directly to 8080 and forces traffic through Apache’s access controls and logging. If Tomcat and Apache are on different hosts, use a protected interface and firewall rules that allow the proxy host only.
Check ownership of port 80
Before enabling Apache, verify that no web server, container, development process, or system service already owns the required address and port. On a Linux system, a command such as ss -ltnp | grep ':80' can identify the listener. Stop or reconfigure the existing service rather than trying to make two processes share the same socket.
Configure Apache as the port-80 reverse proxy
Enable the proxy modules
Apache needs the core proxy module and the HTTP proxy module. Distribution packaging differs: some systems enable modules with a helper command, while others require loading module files and restarting Apache. Confirm that mod_proxy and mod_proxy_http are loaded before testing the virtual host.
Add a virtual host and proxy rules
The following minimal configuration publishes Tomcat’s /myapp context at the same public path:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
<VirtualHost *:80>
ServerName www.example.com
ProxyRequests Off
ProxyPass /myapp http://127.0.0.1:8080/myapp
ProxyPassReverse /myapp http://127.0.0.1:8080/myapp
</VirtualHost>ProxyRequests Off is important: it keeps Apache in reverse-proxy mode instead of accepting forward-proxy requests from arbitrary clients. ProxyPass forwards incoming requests. ProxyPassReverse changes redirect headers generated by Tomcat so a client is not sent to the backend address.
Publish the application at the site root
If the application is deployed as Tomcat’s root context and should answer at http://www.example.com/, proxy the root path instead:
ProxyRequests Off
ProxyPass / http://127.0.0.1:8080/
ProxyPassReverse / http://127.0.0.1:8080/Use a dedicated virtual host for this case. Do not combine a root rule with a more specific application rule without checking rule order, because the root mapping can consume requests intended for another context.
Validate and reload Apache
- Run the distribution’s Apache configuration test, commonly exposed as a command such as
apachectl configtest. Fix every syntax error before reloading. - Enable the virtual host and ensure Apache is configured to listen on port 80 for the intended address.
- Reload or restart Apache using the service manager for your operating system.
- Inspect the Apache error and access logs immediately after the reload. A successful reload does not prove that the backend path is reachable.
Tell Tomcat which public host and port clients use
A proxy creates two connections: client-to-Apache and Apache-to-Tomcat. Without explicit proxy identity, Tomcat may see the second connection and report the backend host and port to the application. Frameworks then build redirects, canonical links, cookies, or API URLs containing 127.0.0.1 or :8080.
Set the public identity on the HTTP Connector while leaving its listening port unchanged:
<Connector port='8080'
proxyName='www.example.com'
proxyPort='80' />proxyName and proxyPort affect values such as request.getServerName() and request.getServerPort(). They do not move Tomcat onto port 80; Apache remains the listener.
Rank #3
- Used Book in Good Condition
When HTTPS terminates at the proxy
If Apache accepts HTTPS and forwards plain HTTP to Tomcat, the application also needs to know that the original request was secure. Configure the Connector’s scheme and secure attributes, or configure your framework’s trusted forwarded-header handling, according to the deployed stack. Trust forwarding headers only from your proxy or another controlled hop; accepting arbitrary client-supplied values can let an attacker spoof the scheme, host, or port.
After changing server.xml or another Connector configuration, restart Tomcat and verify the resulting behavior with a real request. A reload of Apache alone cannot change Tomcat’s view of its public identity.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Verify the complete request path
- From the Tomcat host, request the backend directly:
curl -i http://127.0.0.1:8080/myapp/. A valid application response proves that the Connector and context are working independently of Apache. - From the same host, request the public hostname through Apache:
curl -i http://www.example.com/myapp/. Check the status line,Locationheaders, and whether links refer to the public host. - From an external client, repeat the public request. This catches DNS, firewall, security-group, and address-binding mistakes that a local test cannot see.
- Watch Apache’s access log and Tomcat’s log while making the request. The Apache entry confirms that the edge received traffic; the Tomcat entry confirms that the proxy forwarded it.
- Test a page that produces a redirect, a static asset, a session, and an application-generated absolute URL. A home page alone may not reveal a bad context path or proxy identity.
Use the response status to narrow the fault: a connection failure to port 80 points to the edge listener or network, a proxy-generated 502 or 503 usually points to backend reachability, and an application-generated 404 usually points to the context path or application routing.
Binding Tomcat directly to port 80
Tomcat’s HTTP Connector port attribute selects the TCP port on which it creates its server socket. Setting it to 80 is technically straightforward:
<Connector port='80' />On Unix-like operating systems, port 80 is normally a privileged port. A service launched without the required privilege will fail to bind, often with a permission error. You can grant a narrowly scoped bind capability or arrange for the service manager to provide the needed privilege, but the exact mechanism is operating-system and packaging dependent.
Direct binding also means Tomcat itself is the public edge. You lose the clean separation in which Apache owns port 80, applies edge policy, and can terminate TLS while Tomcat remains a private application process. Choose this design only when that coupling is intentional, documented, and covered by your service hardening and upgrade procedures. Do not run multiple listeners on the same IP address and port expecting the operating system to distribute connections between them.
Rank #4
Using AJP instead of HTTP proxying
Apache can forward to an AJP connector with mod_proxy_ajp:
ProxyRequests Off
ProxyPass /myapp ajp://127.0.0.1:8009/myapp
ProxyPassReverse /myapp ajp://127.0.0.1:8009/myappThis changes only the private hop. Clients still connect to Apache on port 80, and the public URL settings on Tomcat remain relevant.
Apply AJP’s security requirements
AJP is clear text. Apache Tomcat’s security guidance says AJP Connectors should normally be used only on trusted networks. On a same-host deployment, bind the AJP connector to loopback where possible; on separate hosts, firewall it so only the proxy can reach it. Current Tomcat versions require the configured AJP secret by default, so set the secret as required by the exact Tomcat version and configure the matching value on the proxy. A secret does not replace network restrictions or encryption between separate machines.
If you do not have an existing AJP dependency, HTTP proxying is usually simpler: it uses the ordinary HTTP Connector, avoids an additional protocol-specific secret, and is easier to test with standard tools.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchTroubleshoot the failures that appear most often
Apache cannot start: address already in use
Another process has the requested address and port. Identify the listener, then stop it, move it to another port, or configure Apache for a different IP address. Do not solve the conflict by exposing Tomcat and Apache on the same socket; the operating system permits only one listener for that address and port.
Permission denied when Tomcat is configured for 80
The service lacks the Unix privilege needed for a low port. Revert Tomcat to an unprivileged connector and place Apache on port 80, or implement a carefully scoped operating-system capability or service arrangement. Granting broad root execution to the entire Java process is a larger risk than granting only the required bind capability.
Best Value
Apache returns 502 or 503
First request the backend URL locally. If that fails, check that Tomcat is running, that the Connector is listening on the expected address and port, and that the context path is correct. If the local request works, check firewall rules between Apache and Tomcat, the proxy target spelling, and Apache’s error log for connection-refused or timeout details.
The browser is redirected to port 8080
Set Tomcat’s proxyName to the public hostname and proxyPort to 80, then restart Tomcat. Keep ProxyPassReverse in Apache so backend redirect headers are translated. If the public endpoint is HTTPS, also correct the scheme or trusted forwarded-header configuration; changing the port alone does not tell the application that the original request was secure.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The application returns 404 through Apache but works on 8080
Compare the requested path with the deployed Tomcat context. A rule for /myapp cannot serve an application deployed at a different context, and a root-context rule can unintentionally absorb paths meant for another application. Test the exact backend path that Apache is forwarding and review both logs for the resulting URI.
Assets, cookies, or links contain the wrong host
Static files may be generated with an application base path, while cookies may use a path derived from the context. Confirm the application’s external base URL settings and Tomcat’s proxy identity. Do not fix a host or port mismatch by trusting arbitrary Host or forwarded headers from the internet; define which proxy headers are trusted and from which source addresses.
AJP connections fail after a Tomcat upgrade
Check the Tomcat version’s AJP defaults, especially the required secret and permitted addresses. A secret mismatch, an AJP connector disabled by configuration, or a firewall rule can all look like a generic proxy failure. If AJP is not required, switch the private hop to HTTP and use the standard mod_proxy_http path.
Quick Recap
Production hardening and maintenance
- Keep the Tomcat backend listener on loopback or a protected interface whenever the topology allows it.
- Remove unused Tomcat Connectors. Every enabled listener is another network surface to monitor and secure.
- Expose only the Apache listener publicly and restrict administrative or management applications separately from the user-facing context.
- Use
ProxyRequests Offand review Apache’s proxy rules so the server cannot become an open forward proxy. - For AJP, enforce the version-appropriate secret and a trusted network boundary; clear text is not suitable for an untrusted path.
- Keep Apache and Tomcat logs available during rollout. Correlating an edge request with a backend request is the fastest way to distinguish routing, network, and application faults.
- After every hostname, port, TLS, or context-path change, test a redirect and an absolute URL in addition to the home page.
A practical rollout sequence
- Record the deployed context path and the Tomcat backend Connector port.
- Restrict that Connector to loopback or an explicitly protected interface.
- Confirm that port 80 is free on the intended Apache address.
- Enable Apache’s proxy modules and add the matching
ProxyPassandProxyPassReverserules. - Set
proxyNameandproxyPort='80'in Tomcat when the application generates public URLs. - Remove Connectors that the deployment does not use.
- If selecting AJP, configure its required secret and trusted-network restrictions before opening the connector.
- Run local and external
curlchecks while watching both access logs, then test redirects, assets, sessions, and absolute links.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
