Apache configuration explained: files, contexts and merge order

Apache's configuration is spread over several files and uses nested sections such as <VirtualHost>, <Directory> and <Location>. Each directive is valid only in certain contexts, and sections merge in a specific order. Understanding the layout explains why a rule "does nothing" or why another site is affected.

Before you start

• Apache 2.4 on a VPS with sudo access.
• On cPanel servers configuration is generated by the panel; use the include editor in WHM instead of editing files.

Where the files are

The contexts

• Server config: directives outside any section apply to the whole server and act as defaults for every vhost.
• <VirtualHost>: settings for one site, matched by IP:port and ServerName/ServerAlias.
• <Directory> / <DirectoryMatch>: apply to a filesystem path and everything below it.
• <Files> / <FilesMatch>: apply to file names, wherever they are.
• <Location> / <LocationMatch>: apply to URL paths, regardless of where (or whether) a file exists.
• <If>: conditional on an expression, e.g. a header or the host.
• .htaccess: per-directory files, like a <Directory> section that site owners can edit, if allowed by AllowOverride.

Use <Directory> for anything about files on disk (access, options, overrides) and <Location> for things that aren't files, such as /server-status or proxied paths. Protecting files with <Location> can be bypassed through alternate URLs to the same file.

The merge order

For each request Apache applies sections in this order, later ones overriding earlier ones:

1. <Directory> (non-regex), from shortest path to longest, with .htaccess files applied at each level
2. <DirectoryMatch> and <Directory ~>
3. <Files> and <FilesMatch>
4. <Location> and <LocationMatch>
5. <If>

Within the same type, sections are applied in the order they appear in the config. VirtualHost sections are merged after the server-level ones, so a vhost's sections win over global ones of the same type.

Example: secure defaults plus one site

# server config
<Directory />
    AllowOverride None
    Require all denied
</Directory>

<FilesMatch "^\.(ht|env|git)">
    Require all denied
</FilesMatch>

<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/example.com/public
    <Directory /var/www/example.com/public>
        Require all granted
        AllowOverride FileInfo
        Options -Indexes
    </Directory>
</VirtualHost>

Everything is denied by default, dotfiles like .env are never served, and only the site's public folder is opened.

How Apache picks the VirtualHost

1. Find vhosts whose IP:port matches the connection.
2. Among them, match the Host header against ServerName and ServerAlias.
3. No match: the first vhost listed for that IP:port answers. That is why a dedicated default vhost (e.g. 000-default.conf) should come first.

Inspect and test

• Syntax check: sudo apachectl configtest
• List vhosts and which file defines them: sudo apachectl -S
• Loaded modules: apachectl -M
• Apply gracefully: sudo apachectl graceful or systemctl reload apache2.

Troubleshooting

• "... not allowed here": the directive is in a context where it isn't valid.
• Changes have no effect: the file isn't included (site not enabled), or a later section overrides it. Check apachectl -S.
• Wrong site for a domain: ServerName missing, so the first vhost answers.

FAQ: Apache configuration

Should I edit apache2.conf?

Rarely. Put changes in conf-available snippets or vhost files so upgrades don't overwrite them.

What is the difference between reload and restart?

Reload (graceful) re-reads config and lets current requests finish; restart stops everything first.

Does LiteSpeed read these files?

LiteSpeed Enterprise can read Apache configuration directly, which is why it works as a drop-in replacement.

Next steps

• Apache virtual hosts setup
• .htaccess vs VirtualHost
• Apache modules