Almost every Apache feature, from rewriting URLs to TLS, is a separately loaded Apache module. Loading only what you use keeps the attack surface small and lowers memory per process. This guide shows how to see which modules are active and how to enable or disable them on both major Linux families.
Before you start
- Apache 2.4 on a VPS with root access.
- On cPanel servers modules are managed with EasyApache 4 in WHM, not by hand.
List loaded Apache modules
apachectl -MOutput marks each as (static) (compiled in) or (shared) (loaded from a .so file). Only shared modules can be toggled.
Enable and disable on Debian/Ubuntu
Modules live in /etc/apache2/mods-available/; enabled ones are symlinked into mods-enabled/.
- Enable:
sudo a2enmod rewrite headers - Disable:
sudo a2dismod status autoindex - Check one:
a2query -m rewrite
Then validate and restart:
sudo apachectl configtest && sudo systemctl restart apache2The same pattern exists for config snippets (a2enconf/a2disconf) and sites (a2ensite/a2dissite).
Enable and disable on AlmaLinux/Rocky
Modules are loaded by LoadModule lines in /etc/httpd/conf.modules.d/*.conf.
- Find the line:
grep -r autoindex /etc/httpd/conf.modules.d/. - Comment it out with
#to disable, or uncomment to enable. - Extra modules usually come as packages:
sudo dnf install mod_ssl,mod_security,mod_http2. - Run
sudo apachectl configtest && sudo systemctl restart httpd.
Modules a modern server needs
| Module | Purpose |
|---|---|
| mpm_event | Concurrency model (see Apache MPMs) |
| ssl | HTTPS |
| http2 | HTTP/2 (Protocols h2 http/1.1) |
| rewrite | URL rewriting and redirects |
| headers | Security and cache headers |
| proxy, proxy_fcgi | Pass PHP to PHP-FPM |
| setenvif, mime, dir, alias | Core request handling |
| deflate, brotli | Compression |
| expires | Browser caching |
| remoteip | Real client IP behind a proxy or CDN |
| reqtimeout | Slowloris protection |
Modules you can often remove
- autoindex: directory listings. Disable unless you need them.
- status / info: useful, but expose server details; keep only if restricted to localhost.
- cgi, cgid: only for legacy CGI scripts.
- userdir:
/~user/URLs, rarely wanted. - dav, dav_fs: WebDAV, only if used.
- php (mod_php): replace with PHP-FPM to use the event MPM.
Check a module's directives are guarded
Wrap module-specific config in <IfModule mod_headers.c> so Apache still starts if the module is ever disabled. Without the guard, a disabled module makes Apache refuse to start with "Invalid command".
Troubleshooting
- "Invalid command 'RewriteEngine'": mod_rewrite is not loaded. Enable it.
- "Module xyz is already loaded, skipping": two files load it. Remove the duplicate
LoadModule. - Apache won't start after disabling a module: run
apachectl configtest; it names the file and line using it.
FAQ: Apache modules
Does a2enmod restart Apache?
No. It only creates the symlink; restart or reload yourself.
Is reload enough after enabling a module?
A graceful restart (apachectl graceful) loads new modules without dropping connections.
Does LiteSpeed use Apache modules?
No. LiteSpeed implements the common directives itself and ignores Apache module files.