Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRun Ghost as a local Node.js service and let Apache handle the public HTTP and HTTPS traffic. The reliable sequence is: point DNS at the VPS, install Ghost in production mode, keep it listening on localhost, configure Apache as a reverse proxy, obtain a Let’s Encrypt certificate, set Ghost’s canonical URL to the final HTTPS address, and then test redirects, certificates and the admin route.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Ghost-CLI is the supported production installer, but its automatic web-server setup targets NGINX. Using Apache is therefore a manual integration: you retain Ghost’s required proxy headers and process management while writing the Apache virtual hosts yourself.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What the finished architecture looks like
A production Ghost site has two separate layers:
- Ghost: the application process, normally bound to
127.0.0.1:2368so it is not directly exposed to the internet. - Apache: the public reverse proxy listening on ports 80 and 443. It preserves the visitor’s host name, forwards requests to Ghost and, when configured for TLS, tells Ghost that the original request used HTTPS.
The browser never needs to reach port 2368. DNS points your domain to the VPS, Apache receives the request, and Apache passes it to the local Ghost process. This arrangement is what Ghost means when its documentation says that Ghost is designed to have a reverse proxy in front of it.
Use one canonical hostname, such as example.com. If you also publish www.example.com, decide which name is primary and redirect the other to it. A single canonical URL prevents inconsistent links, cookies and search-engine signals.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Before you install anything
Prepare the VPS
Start with a fresh Ubuntu server image from your VPS provider. Create a normal deployment account rather than doing the entire installation as root. You will need administrative access through sudo, a public IPv4 address, and an IPv6 address only if you intend to publish an AAAA record.
Open TCP ports 80 and 443 in both layers of filtering: the VPS operating-system firewall and the provider’s network firewall. Port 80 is needed for initial HTTP access and common certificate-validation flows; port 443 serves the finished HTTPS site. Do not open Ghost’s local port 2368 publicly.
Point DNS at the server
Create an A record for the final hostname pointing to the VPS IPv4 address. Add an AAAA record only when the VPS has working IPv6 connectivity and Apache is listening on it. If you plan to accept www.example.com, create a record for that name as well; otherwise leave it out of both DNS and the certificate request.
Wait until public DNS resolvers return the VPS address before requesting a certificate. You can check from the VPS with a resolver such as dig or getent hosts. A certificate authority cannot validate a name that still points to an old server or has no publicly reachable port 80.
Choose the final URL now
Decide whether the canonical address will be https://example.com or https://www.example.com. Use that exact HTTPS URL when Ghost-CLI asks for the site URL and later confirm it with ghost config url. Ghost’s production configuration requires a URL, and changes take effect after restarting Ghost.
Install Ghost in production mode
Create a deployment directory and user
Ghost-CLI is Ghost’s supported production installation tool. Its normal production flow installs and checks the application, configures MySQL, creates a systemd service and can configure a web server. Because this guide uses Apache, you will adapt the web-server portion rather than allowing an NGINX configuration to become your public proxy.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use a non-root account for the application directory. The following commands illustrate the directory setup; replace the user and path if your operating practice differs:
sudo npm install -g ghost-cli@latest
mkdir -p /var/www/ghost
sudo chown "$USER":"$USER" /var/www/ghost
cd /var/www/ghost
ghost installThe current Ghost-CLI checks determine the supported Node.js release and database requirements for the Ghost version being installed. Follow those checks rather than pinning an old Node.js or MySQL package from an unrelated tutorial. The installer will ask for database details, the site URL and other production settings.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Handle the web-server and SSL prompts
Ghost-CLI’s generated production proxy is NGINX-based. If the installer offers to set up NGINX or its integrated SSL path, remember that Apache will be the public proxy in this deployment. You can skip or remove the NGINX stage and configure Apache manually after Ghost itself is installed. Do not run two competing proxies on ports 80 and 443.
Keep Ghost bound to localhost. A local listener makes Apache the only internet-facing service and avoids exposing the application directly on port 2368.
Check the local service before adding Apache
From the Ghost directory, check the service and its local HTTP response:
ghost status
curl -I http://127.0.0.1:2368The exact status text varies by Ghost version. These commands establish whether Ghost is running before proxy configuration adds another possible failure point. If the local request fails, inspect the Ghost logs and installation checks first; Apache cannot correct an application that is not listening.
Configure Apache as the reverse proxy
Enable the required modules
Ubuntu’s Apache packages provide the proxy, header, rewrite and TLS modules needed for this arrangement. Enable them and reload Apache:
sudo a2enmod proxy proxy_http headers rewrite ssl
sudo systemctl reload apache2proxy and proxy_http forward requests to Ghost. headers sets the forwarding metadata Ghost uses to reconstruct the original request. rewrite supports HTTP-to-HTTPS redirection, and ssl enables TLS virtual hosts.
Create the initial HTTP virtual host
Create /etc/apache2/sites-available/ghost.conf. Replace both example host names with your real canonical host and any intentional alias:
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
ProxyPreserveHost On
ProxyPass / http://127.0.0.1:2368/
ProxyPassReverse / http://127.0.0.1:2368/
RequestHeader set X-Forwarded-Proto "http"
RequestHeader set X-Forwarded-Port "80"
RequestHeader set X-Real-IP "%{REMOTE_ADDR}s"
ErrorLog ${APACHE_LOG_DIR}/ghost-error.log
CustomLog ${APACHE_LOG_DIR}/ghost-access.log combined
</VirtualHost>ProxyPreserveHost On keeps the domain the visitor requested instead of replacing it with the upstream address. ProxyPassReverse lets Apache adjust redirect headers returned by Ghost. The forwarding headers preserve the protocol, port and client address that Ghost cannot see directly because the request first terminates at Apache.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
The file above is an Apache adaptation of Ghost’s documented reverse-proxy requirements, not a file Ghost-CLI generates. Ghost specifically warns that an incorrect X-Forwarded-Proto value can produce an HTTPS redirect loop.
Enable and validate the site
sudo a2ensite ghost.conf
sudo apachectl configtest
sudo systemctl reload apache2apachectl configtest must report a valid configuration before you reload. If Apache still serves its default page, disable the default site or correct the ServerName, DNS record and virtual-host selection. At this stage, an HTTP request should reach Ghost through Apache, although it is not yet encrypted.
Add HTTPS with Let’s Encrypt and Certbot
Install Certbot’s Apache integration
Install Certbot and the Ubuntu Apache plugin using the packages available for your Ubuntu release:
sudo apt update
sudo apt install certbot python3-certbot-apacheRequest a certificate for every name you actually publish. If you use both the apex and www host, request both:
sudo certbot --apache -d example.com -d www.example.comIf you do not use www, omit it from DNS and from the command. The Apache plugin finds the matching virtual host and adds TLS directives. Certificates are placed under /etc/letsencrypt/live/<domain>/.
Inspect the generated HTTPS virtual host
Certbot may create or modify a TLS virtual host. Confirm that the HTTPS block still contains the proxy directives and the HTTPS forwarding headers:
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Port "443"Keep ProxyPreserveHost On, ProxyPass and ProxyPassReverse in the HTTPS virtual host. When Apache terminates TLS, Ghost sees an internal HTTP connection to 127.0.0.1:2368; X-Forwarded-Proto: https is what tells Ghost that the original browser connection was encrypted.
Configure the port-80 virtual host to redirect cleartext traffic to the canonical HTTPS host. Certbot can add this redirect, or you can use an Apache rewrite. Make sure the redirect does not send a request back to HTTP and that the host name is normalized consistently.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Check renewal
Certbot normally installs a systemd timer for renewal. Confirm that a timer exists:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →systemctl list-timers | grep certbotRun a safe renewal simulation:
sudo certbot renew --dry-runA dry run validates the renewal path without replacing the live certificate. Keep port 80 reachable if your selected ACME challenge requires it, and check Apache after future certificate changes.
Set Ghost’s canonical HTTPS URL
Once Apache and the certificate are ready, set the exact public URL in Ghost and restart the service:
cd /var/www/ghost
ghost config url https://example.com
ghost restartUse your chosen canonical hostname in place of example.com. If www is an alias, redirect it to the primary host rather than treating both as separate publications. Ghost’s documentation describes one primary domain for a publication; additional domains should redirect to it.
A wrong URL commonly causes access-denied behavior, redirects to the wrong host, or links containing localhost:2368. Correct the URL, confirm that Apache preserves the host header, and restart Ghost after changing configuration.
Recommended Free Tools
Validate the complete deployment from outside the VPS
Run these checks from another machine or network so that you test public DNS, firewall rules and the certificate rather than only the local service:
curl -I http://example.com
curl -I https://example.com
curl -I https://example.com/ghost/
openssl s_client -connect example.com:443 -servername example.com </dev/nullCheck the following results:
- The HTTP URL redirects once to the chosen HTTPS URL, without bouncing between HTTP and HTTPS.
- The certificate presented on port 443 names the host you requested.
- The HTTPS homepage loads through Apache.
/ghost/reaches the Ghost administrator login rather than an Apache error page.- Uploads and other request bodies are not unexpectedly rejected by proxy or Apache limits.
- Apache’s access and error logs contain the request, while Ghost’s own logs show the application handling it.
Use the browser’s address bar and developer tools to verify that generated links, redirects and cookies use the canonical HTTPS host.
Troubleshoot by symptom
Infinite HTTPS redirect loop
Inspect the HTTPS virtual host first. It must send X-Forwarded-Proto "https", not http. Also check that the HTTP-to-HTTPS redirect exists only on the port-80 host and that Ghost’s configured URL starts with https://. A proxy that terminates TLS but forwards an HTTP protocol value makes Ghost believe every secure request is insecure, so it redirects repeatedly.
The Apache default page appears
Apache is answering, but the request selected the wrong virtual host. Verify that public DNS resolves to this VPS, that ServerName matches the requested host, and that the Ghost site is enabled. Disable the default site if it is taking precedence, then run sudo apachectl configtest and reload Apache.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Ghost redirects to localhost or the wrong domain
Run ghost config url from the Ghost directory and set the final HTTPS address if it is wrong. Confirm ProxyPreserveHost On in the active HTTPS virtual host, then run ghost restart. Clear a cached redirect only after the server-side URL and host handling are correct.
The certificate request fails
Check that the certificate names exactly match DNS records pointing to this VPS, that port 80 is open in both firewalls, and that no other service is answering for the name. Do not request a www certificate until the www record exists and resolves correctly.
Ghost works locally but not through Apache
Re-run curl -I http://127.0.0.1:2368. If it fails, fix Ghost first. If it succeeds, inspect Apache’s error log, confirm proxy_http is enabled, verify the ProxyPass target and trailing slashes, and test the selected virtual host with the intended host name.
Admin access is denied or assets use the wrong scheme
These symptoms usually indicate a mismatch among Ghost’s URL, the preserved host and the forwarded protocol. Correct all three together, restart Ghost, and test https://example.com/ghost/ again. Avoid mixing a secure canonical URL with an HTTP-only proxy header.
Free tools Windows power users keep installed
One-click scans. No signup required.
Operational and security considerations
- Keep Ghost, Ghost-CLI, Node.js, MySQL and Ubuntu aligned with the compatibility checks for the installed Ghost release.
- Use the low-privilege Ghost account and avoid exposing port 2368 publicly.
- Back up the Ghost content directory and database before upgrades or configuration changes.
- Monitor both Apache and Ghost logs; a successful Apache connection does not prove that the application completed the request.
- Retain automatic certificate renewal and periodically run the dry-run test.
- Use HTTPS in production. Ghost recommends SSL because credentials and session traffic would otherwise travel in plaintext.
What Apache changes—and what it does not
Apache changes the front-end proxy layer only. Ghost still runs as the same application process, uses the same database and needs the same production URL, service supervision and updates. The important difference is responsibility: Ghost-CLI documents and generates NGINX configuration, while an Apache deployment requires you to maintain the virtual hosts, proxy modules, forwarding headers, TLS settings and redirect behavior yourself.
There is no authoritative performance benchmark establishing a CPU, memory or requests-per-second advantage for Ghost behind Apache on a VPS. Choose server capacity according to your publication’s workload and monitor it rather than relying on a generic number. The configuration above preserves the protocol and host information Ghost requires; it does not promise a particular throughput.
Quick Recap
Deployment checklist
- Create a non-root deployment account and a fresh Ubuntu VPS.
- Point the domain’s
Arecord, and itsAAAArecord if used, to the VPS. - Open TCP 80 and 443 in both firewalls; keep 2368 private.
- Install Ghost with Ghost-CLI in the chosen directory and complete its MySQL and production checks.
- Keep Ghost listening on localhost and verify it with
ghost statusandcurl -I http://127.0.0.1:2368. - Enable Apache’s proxy, header, rewrite and SSL modules.
- Create and enable the HTTP virtual host with preserved host and forwarding headers.
- Run
sudo apachectl configtestbefore every reload. - Obtain the certificate with Certbot’s Apache plugin after DNS resolves publicly.
- Verify the HTTPS virtual host sends
X-Forwarded-Proto "https"andX-Forwarded-Port "443". - Set Ghost’s canonical URL to the final HTTPS host and restart Ghost.
- Test redirects, the certificate, the homepage,
/ghost/, uploads and both sets of logs from outside the VPS.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
