# Apache 2.4 on Windows: a legacy path, not a default

> Run Apache 2.4 on Windows only for compatibility, with the right binaries, httpd.conf, service install and reverse-proxy limits.

**Tested on**

- Build: 26100.33650
- Edition: Standard / Datacenter
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

Apache 2.4 **runs** on Windows, but it is a compatibility path:

- the ASF does not publish official Windows binaries; most teams use Apache Lounge builds;
- Windows uses `mpm_winnt`, not the Linux MPMs;
- fewer modules and different performance characteristics;
- IIS or Nginx is usually the better default on Windows.

Use Apache only when an app/vendor requires it, or you are migrating an existing `.htaccess`/httpd configuration.

## Install

1. Get a trusted x64 build (Apache Lounge or a vendor you already patch).
2. Extract to `C:\Apache24` (no spaces).
3. Edit `conf/httpd.conf`:
   - `ServerRoot "C:/Apache24"`
   - `Listen 8080` if IIS owns 80
   - `DocumentRoot "C:/sites/lab"`
   - `<Directory "C:/sites/lab">` with `Require all granted`
4. Test and install the service:

```bat
C:\Apache24\bin\httpd.exe -t
C:\Apache24\bin\httpd.exe -k install
C:\Apache24\bin\httpd.exe -k start
```

Use forward slashes in config paths. `httpd -t` must pass before `-k start`.

## Modules

Enable only what the app needs:

```apache
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule ssl_module modules/mod_ssl.so
```

`mod_proxy` without access control can become an open proxy. Restrict `ProxyRequests Off` and proxy only known upstreams:

```apache
ProxyRequests Off
ProxyPass "/app/" "http://127.0.0.1:3000/"
ProxyPassReverse "/app/" "http://127.0.0.1:3000/"
```

`ProxyPassReverse` rewrites redirects; without it, the app may redirect to its internal hostname.

## TLS

```apache
Listen 443
<VirtualHost *:443>
  ServerName lab.local
  SSLEngine on
  SSLCertificateFile "C:/Apache24/conf/lab.crt"
  SSLCertificateKeyFile "C:/Apache24/conf/lab.key"
  DocumentRoot "C:/sites/lab"
</VirtualHost>
```

PEM files again; Windows certificate store is not read directly. Test with `httpd -t` and `openssl s_client`.

## Windows boundaries

| Topic | Apache on Windows |
|---|---|
| Official binaries | Not from ASF; use a trusted build |
| MPM | `mpm_winnt` |
| `.htaccess` | Works, but per-request overhead; prefer vhost config |
| Service | `httpd -k install` |
| Performance | Not Linux-equivalent |
| HTTP/3 | Depends on build/modules; do not assume |

> **Caution: Do not expose a default Apache**
>
> The default page and `server-status` can disclose the install. Remove sample content, restrict `/server-status` to localhost, and keep `ServerTokens Prod`.

## Migration checklist

- Map `DocumentRoot` and vhosts.
- Port every `LoadModule` and `.htaccess` rule; test with `httpd -t`.
- Move TLS PEM/key and set ACLs.
- Replace `ProxyPass` targets; verify `ProxyPassReverse`.
- Test Host header, redirects, uploads and logs.
- Keep IIS/Nginx as the target if Apache is only historical.

## Lab boundary

E1. Apache was not installed in this lab. The commands and config shapes are the migration starting point; validate the exact build and module list on Server 2025.

## Sources

- [Apache HTTP Server — Windows platform](https://httpd.apache.org/docs/2.4/platform/windows.html)
- [Apache HTTP Server — httpd](https://httpd.apache.org/docs/2.4/programs/httpd.html)
- [Apache HTTP Server — Reverse proxy](https://httpd.apache.org/docs/2.4/mod/mod_proxy.html)

---

Source: https://windows.homes/en/server/web/apache-legacy/