Apache HTTP Server 2.0: What's New, Release History & Support Lifecycle

What Is New in Apache HTTP Server 2.0

Apache HTTP Server 2.0 is a major architectural overhaul of the 1.3 series, introducing pluggable Multi-Processing Modules (MPMs), a rebuilt module API, native SSL/TLS support, content filtering, and a dramatically simplified configuration model. Teams running Apache 1.3 in production should expect both significant capability gains and a non-trivial migration effort -- third-party modules in particular require recompilation and likely code changes.

How Do Multi-Processing Modules Change Apache's Architecture in 2.0?

Multi-Processing Modules (MPMs) are the single most architecturally significant change in Apache 2.0 -- they move the core request-handling model out of the server binary and into swappable, compile-time-selectable modules.

In Apache 1.3, the process model was hardcoded: Unix used a prefork model, and other platforms used platform-specific hacks. In 2.0, the MPM you select at build time determines how the server manages processes and threads. The three most important MPMs are:

• prefork -- A non-threaded, pure multi-process model. Closest in behavior to Apache 1.3. Choose this if you rely on non-thread-safe libraries (notably older PHP builds).
• worker -- A hybrid multi-process, multi-threaded model. Each child process spawns multiple threads. This dramatically reduces memory footprint under load and is the preferred choice for most modern deployments.
• winnt -- The native MPM for Windows, which uses a single control process and a pool of worker threads backed by Windows I/O completion ports.

In practice, directives like MaxClients, StartServers, and ThreadsPerChild now live in the MPM module rather than the core server. If you are migrating an httpd.conf from 1.3, check every process/thread tuning directive against the MPM documentation for your chosen model -- many 1.3 directives simply do not exist in worker or event MPMs.

# Example: worker MPM tuning block in httpd.conf
<IfModule worker.c>
    StartServers         2
    MaxClients         150
    MinSpareThreads     25
    MaxSpareThreads     75
    ThreadsPerChild     25
    MaxRequestsPerChild  0
</IfModule>

Watch out for the Unix threading model: on systems with POSIX thread support, Apache 2.0 can run in hybrid mode, but this only improves scalability for I/O-bound workloads. CPU-bound workloads with blocking C extensions still benefit more from prefork isolation.

What Does the New Content Filtering Pipeline Enable in Apache 2.0?

Apache 2.0 introduces a formal content filtering pipeline, allowing modules to register as filters that transform the stream of request or response data as it passes through the server -- a capability that did not exist as a first-class concept in 1.3.

This matters for several common real-world use cases:

• Output compression -- mod_deflate hooks into the output filter chain and compresses responses on the fly for browsers that send Accept-Encoding: gzip. In 1.3, this required third-party patches or external wrappers.
• CGI post-processing -- CGI script output can now be piped through the INCLUDES filter in mod_include, enabling SSI directives inside dynamically generated content.
• External filter programs -- mod_ext_filter lets you plug any external program (a shell script, Python process, etc.) into the filter chain, similar to how CGI programs act as handlers.
• Proxy transformation -- The rewritten mod_proxy uses the filter infrastructure internally, enabling more reliable and extensible proxying behavior.

One important behavior change to be aware of: modules that were handlers in 1.3 but are now implemented as filters (including the INCLUDES filter and PHP) no longer accept requests with PATH_INFO by default. If your application relies on PATH_INFO in SSI or PHP requests, add AcceptPathInfo On to restore the prior behavior.

# Enable gzip compression via mod_deflate filter
<IfModule mod_deflate.c>
    SetOutputFilter DEFLATE
    BrowserMatch ^Mozilla/4 gzip-only-text/html
    BrowserMatch ^Mozilla/4\.0[678] no-gzip
    BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
</IfModule>

What New Modules Ship With Apache 2.0 and What Do They Replace?

Apache 2.0 bundles several modules that were previously third-party add-ons, patches, or experimental code, making a much broader feature set available without additional compilation overhead.

mod_ssl is the headline addition -- a full OpenSSL-backed SSL/TLS implementation that was previously only available through the separate mod_ssl.org patch against Apache 1.3. For most production deployments, this alone justifies the upgrade, as it eliminates maintaining a patched Apache tree just to get HTTPS support.

mod_dav adds WebDAV support (HTTP-based distributed authoring and versioning), enabling clients to directly read, write, copy, and move files on the server via HTTP. This matters if you are running content management workflows or version-controlled web deployments.

mod_auth_ldap (added in 2.0.41) provides LDAP-backed HTTP Basic Authentication, paired with mod_ldap which supplies connection pooling and result caching to prevent authentication requests from hammering your directory server.

The following table summarizes module changes at a glance:

What Configuration Directives Are Removed or Changed in Apache 2.0?

Apache 2.0 removes or renames a significant number of 1.3 directives -- this is the most common source of startup errors when migrating an existing httpd.conf, and reviewing every removed directive before your first 2.0 startup will save considerable troubleshooting time.

The most impactful removals affecting day-to-day configuration are:

• Port and BindAddress removed -- Replace both with the Listen directive. The ServerName directive now accepts a hostname:port syntax for self-referential URLs.
• AccessConfig and ResourceConfig removed -- Replace with explicit Include directives. If you relied on the defaults (conf/access.conf and conf/srm.conf), add them explicitly to your httpd.conf.
• ServerType removed -- The request-handling model is now entirely determined by your selected MPM. There is no inetd-launched MPM in 2.0.
• AddModule and ClearModuleList removed -- The new API allows modules to declare their own ordering explicitly via per-hook priority, making these directives unnecessary.
• FancyIndexing directive removed -- Use IndexOptions FancyIndexing instead.
• ErrorDocument text syntax changed -- Text messages must now be enclosed in double quotes: ErrorDocument 403 "Forbidden".
• CacheNegotiatedDocs now requires an argument -- Change bare CacheNegotiatedDocs to CacheNegotiatedDocs on.

# Apache 1.3 -- DOES NOT WORK in 2.0
BindAddress 192.168.1.1
Port 80
ServerType standalone
AccessConfig conf/access.conf
ResourceConfig conf/srm.conf
ErrorDocument 403 "Access Denied
CacheNegotiatedDocs

# Apache 2.0 -- corrected equivalents
Listen 192.168.1.1:80
ServerName www.example.com:80
Include conf/access.conf
Include conf/srm.conf
ErrorDocument 403 "Access Denied"
CacheNegotiatedDocs on

Also note: the proxy module now uses <Proxy> blocks for access control, not <Directory proxy:...>. If you run a reverse proxy, this configuration section must be rewritten. Most teams underestimate the configuration migration effort -- budget time to diff your 1.3 httpd.conf against the 2.0 defaults line by line.