Apache AH00035 means the httpd worker could not traverse (search) at least one directory in the path to the requested file. Fix it by identifying the exact filesystem path in the error log, checking every parent directory and the file for the Apache worker’s effective permissions, then checking Apache authorization rules and SELinux if Unix permissions are not the cause. Do not “fix” it with chmod 777.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
A 403 response can remain after a mode change because Apache authorization or SELinux can deny access independently of ordinary Unix mode bits. The reliable method is to identify which enforcement layer produced the denial and apply the narrowest reversible correction.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat AH00035 actually means
AH00035 is Apache’s log message for a failed operating-system path traversal check. The usual wording says that access was denied because “search permissions are missing on a component of the path.” In Unix terminology, search means the execute (x) permission on a directory: a process needs it to pass through that directory when resolving a pathname.
Apache Software Foundation documentation describes this class of failure as: “Error 13 indicates a filesystem permissions problem.” The important detail is that the problem can be anywhere between the filesystem root and the requested file. Giving the final file a readable mode does not help if Apache cannot search one of its parents.
#1 Best Overall
The identity that matters is the user and group of the running httpd worker, not the account that owns your login shell or the account that owns the file. Record the active Apache User and Group settings before changing anything. Common names include www-data, apache, or a distribution-specific service account, but use the values from the active configuration and process list rather than assuming a name.
Start with the exact path and identity
- Open the Apache error log and copy the complete path shown beside AH00035. Work from that filesystem path, not just from the URL. URL-to-file mapping can involve aliases, virtual-host document roots, rewrites, or symbolic links.
- Identify the virtual host handling the request and the httpd worker identity. Check the loaded configuration for
UserandGroup, and confirm the running process uses those values. - Note the request time, host name, and URL. This lets you match the failed request with a later test and prevents troubleshooting a different virtual host or a stale log entry.
For example, if the log names /srv/site/public/index.html, every component—/, /srv, /srv/site, /srv/site/public, and the file itself—must be accessible to the worker under the operating system’s permission and security policy.
Check every directory component
Use namei when available
The quickest path audit on systems that provide it is:
namei -m /full/path/to/fileThe -m output displays the mode for each component. Look for a directory in which the Apache user has no execute permission through its owner, group, or “other” class. A directory can be readable yet still unsearchable; read permission controls listing names, while execute permission controls traversing to a known name.
Inspect components individually
If namei is unavailable, inspect the path one directory at a time:
ls -ld /srv /srv/site /srv/site/public /srv/site/public/index.htmlRepeat the command for any symlink target shown by the path. A symlink itself is not the permission boundary that usually matters; Apache must be able to traverse the directory containing the link and every directory in the link’s resolved target path.
Free tools Windows power users keep installed
One-click scans. No signup required.
For each directory, record:
- Owner and group.
- Owner, group, and other mode bits.
- Whether the Apache worker belongs to the group that supplies the needed access.
- Whether an access-control list or a mounted filesystem adds restrictions beyond the displayed mode.
For the target file, Apache normally needs read permission in addition to successful traversal. A common baseline cited in Apache guidance is mode 755 for ordinary directories and 644 for ordinary files, but those are examples, not universal requirements. A site can be more restrictive when ownership, groups, ACLs, and the server’s deployment model are set deliberately.
Rank #2
- Used Book in Good Condition
Do not overlook the directory above the document root
Administrators often change permissions on /var/www/html while leaving a private parent such as /home/account at mode 700. Apache cannot reach the document root through that parent. The same issue occurs with a release directory, a bind mount, or a symlink whose target is under a different private tree. Start at the filesystem root and verify the entire chain.
Apply the narrowest Unix-permission fix
Correct ownership or group membership first
If the content is meant to be served by Apache, assign an appropriate owner and group rather than opening it to every local user. For a shared deployment group, a typical pattern is to make the site group-readable and group-searchable, then add the Apache worker to that group according to your operating system’s account-management policy. Confirm the group is effective for the running service; a login-session group change may not affect an already running process until the service is restarted.
Changing ownership can affect deployment tools, backups, and application writes. Decide which account should own static files and which account, if any, should write uploads or caches. Keep writable directories separate from code and configuration whenever possible.
Grant directory search and file read access precisely
For a directory that should be accessible through a service group, grant only the required owner/group bits. For example, a directory might use group read and search without granting write, while a static file might be group-readable. The exact command depends on the current owner, group, and desired collaboration model; inspect first, then change only the deficient component.
When the Apache worker should traverse a parent directory but users should not list its contents, execute-only access can be appropriate on that parent. Conversely, adding read permission to a parent solely to solve AH00035 may expose directory listings to accounts that do not need them.
Never use chmod 777 as a test
Mode 777 grants all users read, write, and execute access. It can hide the real owner, group, ACL, or SELinux problem while creating a serious security exposure. Apache guidance specifically warns that this approach is unsafe and diagnostically misleading. If a temporary test is unavoidable in a controlled environment, revert immediately and still identify the actual enforcement layer; do not carry the broad mode into production.
Consider ACLs and special filesystems
If the mode and ownership appear correct but access still fails, inspect extended ACLs with the platform’s ACL tools and check whether the path is on a mount with special options or network-backed permissions. An ACL can remove effective access even when the familiar mode bits look permissive. Treat such findings as part of the filesystem-permission layer and document the change so a later deployment does not overwrite it.
Check Apache authorization separately
Unix permission repair does not override Apache’s own authorization engine. A request can be denied by a <Directory> block, an inherited rule, a security module, or a rate-limiting component even when the worker can read the file.
Use a path-specific Apache 2.4 rule
For Apache 2.4, access to an intentionally public directory is commonly expressed with a narrowly scoped block such as:
<Directory /srv/site/public>
Require all granted
</Directory>Use the real filesystem directory that should be public. Do not add a blanket grant for the entire server merely to make one virtual host work. Keep the protective global rule for the filesystem root, typically expressed as a <Directory /> block with Require all denied, and add narrower exceptions only for directories that are meant to be served.
Look for inherited and module-level denials
Search the active virtual-host and included configuration for:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Require all deniedor a more specificRequireexpression inherited from a parent directory.- Conflicting old-style authorization directives mixed with Apache 2.4 rules.
- Directory or location blocks that match the URL but not the filesystem path you inspected.
.htaccessrules that deny access or restrict overrides.- Web-application-firewall, malware-scanning, or rate-limiting modules that reject the request after filesystem traversal.
Apache’s authorization log wording is different from an AH00035 path-traversal message. If a new request produces an authorization denial without AH00035, stop changing Unix modes and correct the matching Apache rule or module policy instead.
Check SELinux when mode bits look right
SELinux can deny httpd even when the owner, group, and mode bits appear correct. In that case the controlling identity is the SELinux domain and file type, not just the Unix user.
Confirm enforcement and inspect labels
Check the current state:
getenforceIf it reports Enforcing, inspect the labels on every relevant directory and the target file:
ls -Z /var/www /var/www/html /var/www/html/index.htmlA moved or copied tree can retain a context that is valid in its old location but not permitted for httpd. Compare the labels with those on a known-good web directory on the same host and with the policy expected by your distribution.
Recommended Free Tools
Find the denial in audit records
Look for an AVC record at the time of the failed request:
ausearch -m avc,selinux_err,user_avc -ts today -iUse the equivalent journal query if audit records are collected elsewhere. Match the source process, target path, operation, and timestamp to the AH00035 request. Unrelated AVC noise is not proof that SELinux caused this particular 403.
Restore the policy-defined context
If the labels are wrong because content was copied or moved, restore the expected contexts instead of disabling SELinux. For a standard web tree, an example is:
restorecon -Rv /var/www/htmlUse the actual document-root path, and understand what the command will relabel before running it. A documented Plesk incident resolved an AH00035 caused by an incorrect context with restorecon -Rv.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not make setenforce 0 a permanent “solution.” Disabling enforcement removes a security boundary and leaves the underlying labeling error unresolved. A temporary diagnostic change, where permitted by your operational policy, should be reverted immediately and followed by a proper label repair.
Create policy only from a confirmed denial
If the labels are correct and the audit record shows a genuine policy denial required by the application, follow the SELinux project’s evidence-based workflow to capture that denial and create a narrowly scoped local rule. Do not generate broad allow rules from unrelated audit messages. A policy that permits every operation by httpd can turn a single path problem into a much larger compromise surface.
Best Value
- Used Book in Good Condition
Validate the correction safely
- Run the platform’s Apache syntax check, commonly
apachectl configtest. Resolve every syntax error before reloading. A successful result is often reported asSyntax OK. - Reload or restart Apache through the distribution’s service manager and your normal change procedure. Service names and reload commands vary, so use the command appropriate for the host rather than copying a command from another distribution.
- Request the exact URL again, preferably with a command-line client that shows the HTTP status and preserves the Host header needed for the virtual host.
- Immediately compare the new error log entry with the original. Confirm whether AH00035 disappeared, whether the failing path changed, or whether the request now produces an authorization or application-level error.
- If SELinux was implicated, check the audit records for a new denial at the same timestamp. If no new denial appears and the response is still 403, return to Apache authorization or application rules rather than relabeling repeatedly.
A changed error is useful evidence. For example, moving from AH00035 to a “client denied by server configuration” message means filesystem traversal is no longer the blocker; investigate the matching authorization rule.
Choose the fix from the evidence
| Where access is denied | Enforcing identity | Typical evidence | Narrowest corrective action |
|---|---|---|---|
| Path traversal or file read | Unix owner, group, mode, ACL, or filesystem | AH00035; namei -m or ls -ld shows a missing search/read permission |
Repair the affected component’s owner, group, ACL, or minimum x/r permission |
| Apache authorization | Loaded httpd configuration or an Apache module | Authorization-denial wording, matching Require or module rule, no corresponding filesystem failure |
Adjust the intended path-specific rule; retain global denial defaults |
| SELinux policy | SELinux domain and file type | AVC record matching the request; labels from ls -Z do not match policy |
Restore the expected context or add a narrowly scoped policy rule supported by the audit evidence |
Common scenarios and recovery paths
“I changed the file to 644, but AH00035 remains”
Mode 644 affects the file, not its parents. Run namei -m on the complete path and locate the first directory lacking execute/search access for the Apache identity. Correct that directory’s group or minimum execute permission, then retest.
“The document root is 755, but the site is still 403”
Inspect every ancestor above the document root, including a user home directory, deployment release path, mount point, or symlink target. If traversal succeeds, inspect the matching Apache <Directory> rules and then SELinux labels and AVC records. Do not keep broadening Unix modes after the evidence points to another layer.
“It worked until content was moved”
Moving or copying files can change ownership, ACLs, and SELinux contexts. Re-run the path audit, compare labels with a known-good tree, and use restorecon when policy-defined contexts were lost. If the destination is outside the distribution’s standard web paths, verify that the SELinux policy actually permits httpd to read it before creating any local rule.
“A configuration change fixed one host but broke another”
Apache directory rules are evaluated against filesystem paths and can be inherited by multiple virtual hosts. Scope a grant to the intended directory, verify which virtual host answers the request, and test each affected hostname separately. Avoid changing the global <Directory /> policy to solve a single site.
“There is no AH00035 after the change, but the response is still 403”
Read the new log message. A remaining 403 may come from Require authorization, an application rule, a security module, or a deliberate denial of directory indexes. The absence of AH00035 means the original path-traversal failure is no longer the demonstrated cause.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Prevent repeat incidents
- Keep application code, public assets, uploads, and secrets in separate directories with different ownership and write requirements.
- Record the intended Apache user, group, document roots, and SELinux labeling policy in deployment documentation.
- Use deployment steps that preserve ownership, ACLs, and security contexts when copying or extracting releases.
- Test a representative URL after every document-root or virtual-host change and retain the corresponding error-log entry.
- Review parent-directory permissions during migrations; a correct final directory is insufficient if an ancestor is private.
- Preserve the global deny-by-default filesystem rule and add only explicit public-directory exceptions.
- Monitor AVC records and Apache error logs so a policy or ownership regression is detected before users see repeated 403 responses.
A compact troubleshooting checklist
- Copy the full filesystem path from the AH00035 entry.
- Record the active Apache
UserandGroup. - Run
namei -m, or inspect each component withls -ld. - Verify Apache can search every parent and read the target file.
- Repair only the required owner, group, ACL, or mode; never use
777. - Check matching Apache
<Directory>,Require,.htaccess, and module rules. - Run
getenforce, inspectls -Z, and search AVC records when Unix permissions look correct. - Use
restorecon -Rvfor incorrect policy-defined labels; create a local SELinux rule only when audit evidence proves it is needed. - Run
apachectl configtest, reload through the host’s service manager, request the URL again, and read the new logs.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
