Configure Apache HTTP/2 with performance optimization and modern security headers

Intermediate 25 min Apr 07, 2026 912 views
Ubuntu 24.04 Debian 12 AlmaLinux 9 Rocky Linux 9

Enable HTTP/2 protocol in Apache with SSL/TLS encryption, implement advanced performance optimization settings including compression and caching, and configure modern security headers for production deployments.

Prerequisites

  • Root or sudo access
  • Basic Apache knowledge
  • SSL certificate or ability to generate one

What this solves

HTTP/2 provides significant performance improvements over HTTP/1.1 through multiplexing, server push, and header compression. This tutorial configures Apache with HTTP/2 support, SSL/TLS encryption, performance optimization settings, and modern security headers for production environments.

Step-by-step configuration

Update system packages and install Apache

Start by updating your system and installing Apache with SSL support.

sudo apt update && sudo apt upgrade -y
sudo apt install -y apache2 apache2-utils ssl-cert
sudo dnf update -y
sudo dnf install -y httpd mod_ssl openssl

Enable HTTP/2 and SSL modules

Enable the required modules for HTTP/2, SSL, and performance optimization.

sudo a2enmod ssl
sudo a2enmod http2
sudo a2enmod rewrite
sudo a2enmod deflate
sudo a2enmod expires
sudo a2enmod headers
sudo a2enmod cache
sudo a2enmod cache_disk
sudo sed -i 's/#LoadModule ssl_module/LoadModule ssl_module/' /etc/httpd/conf.modules.d/00-ssl.conf
echo "LoadModule http2_module modules/mod_http2.so" | sudo tee /etc/httpd/conf.modules.d/10-http2.conf
echo "LoadModule rewrite_module modules/mod_rewrite.so" | sudo tee -a /etc/httpd/conf.modules.d/00-base.conf

Generate SSL certificate

Create a self-signed SSL certificate for testing. Replace with a proper certificate from Let's Encrypt or your CA in production.

sudo mkdir -p /etc/ssl/private
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/ssl/private/apache-selfsigned.key \
  -out /etc/ssl/certs/apache-selfsigned.crt \
  -subj "/C=US/ST=State/L=City/O=Organization/CN=example.com"

Configure Apache main settings

Set up the main Apache configuration with HTTP/2 support and performance optimizations.

# HTTP/2 Configuration
Protocols h2 h2c http/1.1
H2Direct on
H2Upgrade on
H2StreamMaxMemSize 512000
H2MaxSessionStreams 100
H2InitialWindowSize 65536
H2MaxWorkerIdleSeconds 600

# Performance Optimizations
ServerTokens Prod
ServerSignature Off
KeepAlive On
KeepAliveTimeout 5
MaxKeepAliveRequests 100
Timeout 300

# Compression Settings
DeflateCompressionLevel 6
SetEnvIfNoCase Request_URI \
    \.(?:gif|jpe?g|png|webp|ico|svg)$ no-gzip dont-vary
SetEnvIfNoCase Request_URI \
    \.(?:exe|t?gz|zip|bz2|sit|rar)$ no-gzip dont-vary
# HTTP/2 Configuration
Protocols h2 h2c http/1.1
H2Direct on
H2Upgrade on
H2StreamMaxMemSize 512000
H2MaxSessionStreams 100
H2InitialWindowSize 65536
H2MaxWorkerIdleSeconds 600

# Performance Optimizations
ServerTokens Prod
ServerSignature Off
KeepAlive On
KeepAliveTimeout 5
MaxKeepAliveRequests 100
Timeout 300

# Compression Settings
DeflateCompressionLevel 6
SetEnvIfNoCase Request_URI \
    \.(?:gif|jpe?g|png|webp|ico|svg)$ no-gzip dont-vary
SetEnvIfNoCase Request_URI \
    \.(?:exe|t?gz|zip|bz2|sit|rar)$ no-gzip dont-vary

Configure SSL virtual host with HTTP/2

Create a virtual host configuration with SSL, HTTP/2, and security headers.

Configure HTTP to HTTPS redirect

Set up automatic redirection from HTTP to HTTPS for security.

Configure MPM for HTTP/2 optimization

Tune the Multi-Processing Module settings for optimal HTTP/2 performance.

sudo a2dismod mpm_prefork
sudo a2enmod mpm_event
# Comment out prefork module
#LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
# Enable event module
LoadModule mpm_event_module modules/mod_mpm_event.so

Enable sites and restart Apache

Enable the configurations and restart Apache to apply changes.

sudo a2enconf http2
sudo a2ensite https-example
sudo a2ensite http-redirect
sudo apache2ctl configtest
sudo systemctl restart apache2
sudo systemctl enable apache2
sudo httpd -t
sudo systemctl restart httpd
sudo systemctl enable httpd
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Create test content

Create sample content to test HTTP/2 functionality and performance features.

sudo mkdir -p /var/www/html/css /var/www/html/js



    
    
    
    
    


    <h1>Apache HTTP/2 Configuration Test</h1>
    <p>This page tests HTTP/2, compression, and security headers.</p>
    <div></div>


body {
    font-family: Arial, sans-serif;
    margin: 40px;
    background-color: #f4f4f4;
}

h1 {
    color: #333;
    border-bottom: 2px solid #007acc;
    padding-bottom: 10px;
}

#protocol-info {
    background: #007acc;
    color: white;
    padding: 20px;
    border-radius: 5px;
    margin-top: 20px;
}
document.addEventListener('DOMContentLoaded', function() {
    const protocolInfo = document.getElementById('protocol-info');
    const protocol = window.location.protocol;
    const host = window.location.host;
    
    protocolInfo.innerHTML = `
        <h3>Connection Information</h3>
        <p><strong>Protocol:</strong> ${protocol}</p>
        <p><strong>Host:</strong> ${host}</p>
        <p><strong>User Agent:</strong> ${navigator.userAgent}</p>
    `;
});

Set correct file permissions

Set proper ownership and permissions for web files. Never use chmod 777 as it gives unnecessary access to all users.

Never use chmod 777. It gives every user on the system full access to your files. Instead, fix ownership with chown and use minimal permissions.
sudo chown -R www-data:www-data /var/www/html
sudo find /var/www/html -type d -exec chmod 755 {} \;
sudo find /var/www/html -type f -exec chmod 644 {} \;
sudo chown -R apache:apache /var/www/html
sudo find /var/www/html -type d -exec chmod 755 {} \;
sudo find /var/www/html -type f -exec chmod 644 {} \;

Verify your setup

Test your HTTP/2 configuration and performance optimizations.

# Check Apache status and configuration
sudo systemctl status apache2  # or httpd on RHEL-based
sudo apache2ctl configtest     # or httpd -t on RHEL-based

# Test HTTP/2 support
curl -I --http2 -k https://example.com/

# Check enabled modules
apache2ctl -M | grep -E '(http2|ssl|deflate|headers|expires)'  # Ubuntu/Debian
httpd -M | grep -E '(http2|ssl|deflate|headers|expires)'       # RHEL-based

# Test compression
curl -H "Accept-Encoding: gzip,deflate" -k https://example.com/ -v

# Check SSL configuration
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -text | grep -A2 "Subject:"

# Monitor Apache processes
ps aux | grep apache2  # or httpd

Performance monitoring and optimization

Monitor your Apache HTTP/2 performance and implement additional optimizations. You can integrate with existing monitoring solutions like Prometheus and Grafana for comprehensive metrics collection.

Enable Apache status module

Configure server status monitoring for performance analysis.

sudo a2enmod status
Note: For production deployments, consider implementing rate limiting with mod_security and mod_evasive to protect against abuse and DDoS attacks.

Common issues

SymptomCauseFix
HTTP/2 not workingSSL not properly configuredVerify SSL certificate and enable SSL engine
High memory usageMPM settings too aggressive

Automated install script

Run this to automate the entire setup

#apache #http2 #ssl #performance #security

Related tutorials

hosting Intermediate

Setup OpenResty load balancing with health checks and automatic failover

Configure OpenResty with upstream backend servers, implement health monitoring, and set up automatic failover for high availability load balancing.

45 min 4 distros 575 views
hosting Intermediate

Configure Apache reverse proxy with caching for microservices

Set up Apache HTTP Server as a reverse proxy with intelligent caching for microservices architectures. This tutorial covers mod_proxy, mod_cache configuration, cache policies, and monitoring for high-performance service delivery.

25 min 4 distros 447 views
hosting Advanced

Implement Apache load balancing with SSL termination and health checks

Configure Apache HTTP Server 2.4 with mod_proxy_balancer for high availability load balancing, SSL termination using Let's Encrypt certificates, and automated backend health monitoring with mod_proxy_hcheck for production environments.

45 min 4 distros 548 views
Browse all tutorials in our complete directory →

Don't want to manage this yourself?

We handle infrastructure for businesses that depend on uptime. Fully managed, with one fixed contact who knows your setup.

You get one fixed contact who knows your setup

Rotterdam 01:24 · reachable in a message, no ticket form

+31 10 477 5362 WhatsApp