Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To set up Apache as a reverse proxy, enable the proxy modules your backend needs, create a virtual host for the public hostname, and map its URL path to a fixed backend address with matching ProxyPass and ProxyPassReverse directives. Keep ProxyRequests Off: reverse proxying sends public requests to a backend; it does not require Apache to act as a forward proxy. This guide shows the basic configuration, path and WebSocket variations, validation steps, architecture choices, cost considerations, and common fixes. Exact module-loading commands, configuration-file locations, and config-test commands vary by operating system and Apache installation.
What does an Apache reverse proxy do?
A reverse proxy sits between visitors and an application server. The visitor connects to Apache at the public hostname; Apache forwards the request to a configured backend and returns the response. To the visitor, Apache appears to be the web server. The backend can be kept from direct external access when the architecture is designed to isolate it.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
This arrangement gives Apache the public-facing role while an application listens on a separate address or port. For example, a web application might listen on 127.0.0.1:3000, while Apache serves requests for app.example.com. The example address is local to the Apache machine; replace it with the actual backend address and port for your deployment.
Apache’s official description is useful here: a reverse proxy or gateway “appears to the client just like an ordinary web server.” Clients do not need to know which process, port, or private host ultimately serves the response. That separation lets you place a public web server in front of an application without changing the application’s public DNS name.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
What do ProxyPass and ProxyPassReverse do?
ProxyPass maps an incoming URL path to a backend URL. ProxyPassReverse adjusts certain redirect-related response headers so that redirects from the backend continue to use the public-facing proxy rather than exposing an internal backend address.
ProxyPasscontrols where matching requests are sent.ProxyPassReverseadjustsLocation,Content-Location, andURIresponse headers when the backend sends them.ProxyPassReversedoes not rewrite links or absolute URLs inside an HTML response body.
That last distinction matters: a redirect header and a link embedded in a page are different things. If an application generates HTML containing absolute backend URLs, header rewriting alone will not make those links use the public hostname. The application may need to be configured to generate public URLs, or a separate HTML-rewriting approach may be required.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThink of the two directives as complementary but not interchangeable. The first determines the destination of an incoming request. The second changes selected response headers on the way back. Omitting the first means Apache has no route to the application; omitting the second can let a backend redirect reveal a private hostname or send a browser around Apache.
How do I configure a basic Apache reverse proxy?
Use a virtual host for the public name, point the proxy mapping at a fixed backend URL, and provide a matching reverse mapping. The following example proxies all paths on an HTTP virtual host to a local application listening on port 3000:
<VirtualHost *:80>
ServerName app.example.com
ProxyPass "/" "http://127.0.0.1:3000/"
ProxyPassReverse "/" "http://127.0.0.1:3000/"
</VirtualHost>Use the backend protocol and address that the Apache server can actually reach. If the app runs on a different machine, substitute its reachable backend URL; do not assume that a loopback address on Apache refers to another host. The example is a configuration pattern, not a complete server installation: the virtual host must be placed in a file Apache loads, and the relevant modules must be available.
1. Identify the public and private sides
Write down the public hostname, listener, URL prefix, backend hostname or IP address, backend port, and protocol before editing Apache. This prevents a common mistake in which a developer copies 127.0.0.1 even though the application is on another server. A loopback address always means the machine running Apache. For a remote backend, use an address routable from that Apache host and confirm that network rules permit the connection.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsDecide whether Apache will proxy the entire site or only a prefix such as /app/. Also list paths that must remain local to Apache, such as a deliberately served static area or an administrative endpoint. Making this URL ownership explicit helps prevent a broad root mapping from capturing requests that should never reach the application.
2. Install Apache and confirm the required modules
Install Apache HTTP Server using your operating system’s package method. Make sure mod_proxy and the proxy scheme support required by the backend are enabled or built into the server. For an HTTP backend, that means the HTTP proxy support. Apache may load modules dynamically or include them statically; the module setup therefore depends on the platform and package.
Do not assume that a package with the word “proxy” in its name enables every protocol. The required set depends on whether the upstream uses HTTP, another supported scheme, a Unix socket, WebSockets, or a balancer configuration. Check the module reference for the Apache version installed rather than copying directives intended for a different release.
3. Create the public virtual host
Set the virtual host’s ServerName to the hostname visitors will use. The sample uses port 80 to illustrate the mapping. Adapt the virtual-host listener and TLS configuration to the actual public service; this example does not configure HTTPS certificates or TLS termination.
If the same Apache instance serves several hostnames, keep each application’s virtual host and mappings separate. A request can then be associated with the intended public name before path rules are evaluated. Test with the real hostname, not only a direct request to the backend, because host selection and proxy behavior are part of the deployment.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
4. Add the request and response mappings
Set ProxyPass to the public path and backend URL, then add a corresponding ProxyPassReverse rule. Keep the backend destination explicit and fixed rather than allowing request input to determine where Apache connects. If you use a path prefix instead of the whole site, follow the trailing-slash rule in the next section.
For a root mapping, both sides in the example end in /. For a subpath mapping, make the public and backend paths describe the same intended URL transformation. Record the mapping in deployment documentation so another administrator can tell whether the backend expects a leading prefix or expects Apache to remove one.
5. Keep forward proxying disabled
For a reverse-proxy deployment, use ProxyRequests Off. ProxyRequests controls forward-proxy mode, which is not needed for this gateway pattern. An open forward proxy can be abused by outside users, so do not enable it casually.
Apache’s warning is direct: “Open proxy servers are dangerous both to our network and to the Internet at large.” A reverse proxy should have deliberate, fixed destinations and a known set of public routes. If you find yourself accepting a target host from a query parameter or request header, stop and redesign that rule rather than turning on general forwarding.
6. Test, reload, and verify
Run the Apache configuration-test command provided by your operating system or installation before reloading the service. The exact command is platform-dependent. A successful syntax test only shows that Apache can parse the configuration; it does not prove that the backend is running, reachable, or generating correct public URLs.
After a successful test, reload Apache using the platform’s service method and request the public hostname. Confirm that the expected application responds. Check the Apache access and error logs, then test at least one normal page, one known asset, an application redirect, a cookie-setting flow, and any endpoint that uses a different path. Make the request through Apache, not directly to the backend, so the full route is exercised.
How do I proxy only a path such as /app/?
Use the same path prefix on the public side and the backend side when the application is mounted at the corresponding backend path. For example:
ProxyPass "/app/" "http://127.0.0.1:3000/"
ProxyPassReverse "/app/" "http://127.0.0.1:3000/"When one side of a mapping ends in a slash, the other should also end in a slash. Inconsistent trailing slashes can cause backend paths to be assembled without the separator the application expects. Verify the actual paths the app receives, especially if it serves its own assets or redirects.
In this example, a request for /app/dashboard is sent using the mapping’s path substitution. Whether the application should see /dashboard or /app/dashboard depends on the backend URL in your rule. Choose that behavior intentionally; do not infer it from the public URL alone.
If some paths on the same hostname should remain local to Apache, place the exclusions before a broader proxy mapping. Order matters because a broad mapping can match a request before a more specific exception is reached. Decide which URL space belongs to Apache and which belongs to the application, then document that mapping so later changes do not accidentally route local paths to the backend.
Path-specific routing is especially sensitive to generated URLs. An application that believes it is mounted at the site root may emit /static/app.js when the public URL is actually /app/static/app.js. Since ProxyPassReverse does not rewrite HTML bodies, fix the application’s public-base-path setting where possible and verify the resulting links in a browser or with an HTTP client.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
How do I proxy WebSockets through Apache?
Apache HTTP Server 2.4.47 and later documents WebSocket upgrade proxying with the upgrade=websocket parameter. A path-specific example is:
ProxyPass "/socket/" "http://127.0.0.1:3000/socket/" upgrade=websocketCheck the documentation for the Apache version installed on the server and the WebSocket requirements of the application framework before using this form. A configuration that works for ordinary HTTP requests does not by itself prove that the WebSocket endpoint is reachable or that upgrade handling is correct. If the connection fails, check the installed Apache version, the upgrade handling, and the backend endpoint and logs.
Test the WebSocket URL separately from the application’s normal pages. Confirm that the public path exactly matches the backend endpoint, that the backend is listening on the expected address and port, and that Apache’s error log records no upgrade or connection failure. A page loading successfully only proves ordinary HTTP proxying; it says nothing about a persistent upgraded connection.
Should I use one backend, path routing, or a balancer?
A single-backend mapping is the simplest starting point. More complex routing or a balancer group can make sense when you need to distribute traffic, handle backend failure, or proxy multiple application paths, but those choices add operational decisions beyond the basic mapping.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Pattern | Best fit | What to consider |
|---|---|---|
| Single backend | One application endpoint behind Apache | Keep the public-to-backend mapping straightforward and verify backend reachability. |
| Path-specific routing | An application served below a URL prefix, or separate paths routed deliberately | Plan path ownership and trailing slashes; exclusions should precede broader mappings. |
| Balancer group | A deployment that needs multiple backends, distribution, or failover behavior | Consider health checks, session handling, TLS termination, observability, and the operational cost of managing the group. |
Apache’s advanced proxy guidance covers clusters and balancers, failover, and health checks. Those features should be selected to meet an actual routing or resilience requirement; they are not necessary to make a single application reachable through Apache.
A balancer also changes the questions you must answer: how a failed member is detected, whether user sessions can move between members, how deployments drain existing connections, and how operators observe each backend. If those questions do not have clear answers, a single fixed backend is easier to validate and support.
The configuration above does not establish a throughput or latency expectation. Apache performance depends on the server, application, network, connection pattern, and workload; no universal benchmark number belongs in a basic setup guide. Measure the deployment you actually operate if capacity planning matters.
What are the TLS and hosting decisions?
The basic example listens on port 80 and demonstrates request forwarding only. A production deployment may put HTTPS on Apache and terminate TLS there, pass encrypted traffic elsewhere, or use another arrangement required by the application. Certificate issuance, listener definitions, and security policy depend on the operating system and hosting environment, so validate those settings separately from the proxy mapping.
Recommended Free Tools
Apache can run on a self-managed server, a VPS, or managed Linux hosting. The practical cost is not just the monthly host bill: include the time to maintain Apache, monitor the backend, handle certificates and updates, review logs, and operate any balancer or failover configuration. A single small backend generally has less operational overhead than a multi-node group. Compare providers by current pricing, geography, network access to the backend, administrative access, and support for the Apache version and modules you need rather than choosing on a generic “hosting” label.
How do I keep the proxy and backend secure?
Use Apache as the deliberate public gateway, not as an unrestricted relay. Apache warns that open proxy servers are dangerous to both the network and the wider internet. For a reverse proxy, leave forward-proxy mode off and keep backend destinations explicit.
- Restrict administrative access to the server and its configuration.
- Keep the backend from being independently exposed when the design requires it to be reachable only through Apache.
- Check backend reachability from the Apache machine, not only from a developer workstation.
- Use the access-control and firewall mechanisms appropriate to the operating system and application; the exact commands differ by environment.
- Review every new mapping to ensure it points to an intended service and cannot be changed by request data.
Proxying does not automatically create isolation. Whether the backend is private depends on how it is bound, what network rules allow, and how the host is configured. Confirm that boundary directly instead of assuming the presence of ProxyPass makes the backend inaccessible from outside.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Why is the reverse proxy failing?
Start with the symptom and check the corresponding layer: backend connectivity, response redirects, URL construction, path mapping, or WebSocket upgrade handling. The Apache error log and a request made through the public hostname help distinguish a routing problem from an application response issue.
Apache returns 502 or a connection error
Apache may be unable to connect to the backend address, port, protocol, or Unix socket in the mapping. Verify that the backend is running and reachable from the Apache host at that exact destination, then check the Apache error log for connection details. A backend reachable from another machine is not necessarily reachable at the address Apache is configured to use.
Check for simple mismatches first: an HTTP mapping aimed at an HTTPS-only service, a stale port, a stopped process, a socket path Apache cannot access, or a firewall rule that allows a different source host. Correct the destination and retest through the public hostname after each change.
A redirect exposes the backend hostname
Check that ProxyPassReverse matches the relevant backend URL and public path. This directive adjusts specific response headers; a missing or mismatched reverse mapping can leave a redirect pointing at the internal hostname. If the hostname appears in page content rather than a redirect header, investigate the application’s generated URLs instead.
Links or assets break under a subpath
The app may be emitting absolute URLs in its HTML that do not include the public path prefix. ProxyPassReverse does not rewrite HTML bodies, so verify how the application is configured to generate its links and asset paths. Also confirm that the public and backend mapping paths use consistent trailing slashes.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Requests reach the wrong backend path
Compare the public path, the backend URL path, and the slash at the end of each mapping. A missing or doubled segment commonly points to inconsistent slash handling or a mismatch between the path Apache maps and the path the application serves. Test a specific known route through the public hostname and inspect the backend’s request log if available.
WebSocket connections fail while pages load
Check whether the installed Apache version supports the documented upgrade=websocket form, whether the relevant proxy mapping uses the actual WebSocket endpoint, and whether the backend is listening there. Ordinary page delivery and a successful WebSocket upgrade are separate checks.
Only some URLs bypass the intended virtual host
Verify the hostname used for the request and the ServerName in the virtual host. When several virtual hosts share a listener, a request made with an unexpected host can select a different configuration. Test with the exact public name and keep each host’s proxy rules clearly separated.
When should I use RewriteRule with the [P] flag?
Use RewriteRule with the [P] flag for regex-based or conditional routing when a straightforward proxy mapping is insufficient. If a fixed mapping will do, Apache recommends using ProxyPass or ProxyPassMatch instead. Prefer the simpler directive when it expresses the URL-space behavior clearly.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Regular-expression routing can be powerful, but it makes review and troubleshooting harder. Document the condition, the expected capture groups, and the backend URL produced for representative requests. Do not replace a clear fixed rule with a rewrite merely because it is shorter.
Deployment checklist
- Confirm the public hostname, listener, URL prefix, backend address, port, and protocol.
- Install Apache and verify that
mod_proxyplus the needed scheme support are loaded or built in. - Create the correct virtual host and keep unrelated hostnames separate.
- Add fixed
ProxyPassand matchingProxyPassReversedirectives. - Match trailing slashes and place any exclusions before broad mappings.
- Set
ProxyRequests Offand review that no rule creates an open forward proxy. - Run the installation’s configuration test, reload Apache, and inspect the logs.
- Test ordinary pages, redirects, cookies, assets, and the backend’s known routes through the public hostname.
- If applicable, test WebSocket upgrades using the installed Apache version’s documented syntax.
- Confirm that the backend’s network exposure, administrative access, TLS plan, monitoring, and operating cost match the intended architecture.
Frequently Asked Questions
Does the backend have to run on the same machine as Apache?
No. The backend can be on another host if Apache can reach its configured address and protocol. A loopback address such as 127.0.0.1 always refers to the Apache machine itself.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Can I serve a normal website and reverse-proxy an app from the same Apache host?
Yes, Apache virtual hosts and path mappings can define which public host or URL path is handled by a proxy. Keep the intended local and proxied URL spaces explicit so a broad mapping does not capture requests meant for a local path.
Does the basic example configure HTTPS for visitors?
No. The sample uses an HTTP virtual host on port 80 and demonstrates request forwarding only; it does not configure certificates or TLS termination. Add and validate the HTTPS virtual-host configuration appropriate to your Apache installation and deployment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why do I need both ProxyPass and ProxyPassReverse?
ProxyPass sends matching requests to the backend. ProxyPassReverse adjusts selected redirect-related response headers so backend redirects continue to use the public proxy address.
Does ProxyPassReverse rewrite links in HTML?
No. It rewrites specific response headers such as Location, Content-Location, and URI. Absolute URLs embedded in an HTML body require application configuration or a separate HTML-rewriting method.
What does a trailing slash change?
Apache recommends matching trailing-slash behavior on the public and backend sides of a mapping. Inconsistent slashes can produce missing separators or incorrect backend paths, especially for applications mounted below a prefix.
How do I avoid creating an open proxy?
Leave ProxyRequests Off, use explicit fixed backend destinations, and do not let request data choose an arbitrary host or port. Open forward proxies can be abused by outside users.
Which Apache version supports the documented WebSocket option?
Apache HTTP Server 2.4.47 and later documents the upgrade=websocket parameter. Confirm the installed version and the backend framework’s endpoint requirements before deploying it.
When is a balancer worth the extra complexity?
Use a balancer when you have a real need for multiple backends, traffic distribution, or failover. Plan health checks, session handling, TLS termination, observability, and the additional operational cost before introducing one.
What should I check first for a 502 response?
Verify that the backend is running and reachable from the Apache host at the exact configured address, port, protocol, or socket. Then inspect Apache’s error log for the connection failure.
The Bottom Line
Start with one explicit virtual host, a fixed ProxyPass/ProxyPassReverse pair, and ProxyRequests Off. Match path slashes, test from the Apache machine and through the public hostname, and treat redirects, HTML-generated URLs, WebSockets, TLS, and backend isolation as separate verification tasks. Add path routing or a balancer only when the deployment has a clear requirement for them.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
