Apache Statistics Module

Apache Statistics Module

The Apache statistics, or status, module provides an interface for viewing current server activity and performance statistics. The module is loaded by default but must be enabled and protected before use.

In this article

Enable the Statistics Module

1

Open Apache Configuration Manager

Locate the Apache application server in the environment and click Config.

2

Open httpd.conf

The required status_module is already loaded. Navigate to /etc/httpd/conf and open httpd.conf.

3

Add the statistics configuration

Add the following block to the Apache configuration:

ExtendedStatus On

<Location /statistics/>
    SetHandler server-status

    ####### Security configuration ####################
    ####### Basic auth config should follow here ######
    ###################################################
</Location>
i

Custom location

The example uses /statistics/. You can use another context path for the server-status page.

Enable the Apache statistics module
Enable ExtendedStatus and configure the server-status location in httpd.conf.
4

Save and restart Apache

Save the updated configuration and restart the Apache application server.

Open the Statistics Page

Click Open in Browser for the environment and append the configured location to the environment URL:

http://{environment_name}.{hoster_domain}/{location_name}/

For the example configuration, use:

http://{environment_name}.{hoster_domain}/statistics/

The page displays Apache server statistics after the configuration is active.

Configure Authentication

!

Protect the statistics page

The status page can expose server activity and request information. Add authentication before making the page accessible.

1

Generate an htpasswd entry

Use an htpasswd tool to generate a username and password hash.

2

Create the password file

Place the generated username and hash in a plain text file.

3

Upload the password file

Open Apache Configuration Manager and upload the file to /var/www/webroot/ROOT.

4

Add Basic authentication

Replace the security placeholder inside the statistics Location block with:

AuthName "Statistics area"
AuthType Basic
AuthBasicProvider file
AuthUserFile /var/www/webroot/ROOT/.htpasswd
Require valid-user

The complete protected configuration becomes:

ExtendedStatus On

<Location /statistics/>
    SetHandler server-status

    AuthName "Statistics area"
    AuthType Basic
    AuthBasicProvider file
    AuthUserFile /var/www/webroot/ROOT/.htpasswd
    Require valid-user
</Location>
Protect the Apache statistics page with authentication
Add Basic authentication inside the statistics Location block.
5

Restart and sign in

Save the configuration, restart Apache, and reopen the statistics URL. Enter the credentials used when generating the password hash.

✓

Use HTTPS

Basic authentication should be used over HTTPS so the credentials and statistics data are encrypted in transit.

Expected Result

The Apache server-status page is available at the configured location and displays server performance statistics only after the visitor enters valid credentials.

Important Notes

  • The Apache status_module is loaded by default but the statistics page is disabled initially.
  • Use a custom URL context when required.
  • Restart Apache after changing httpd.conf.
  • Protect the statistics location with authentication and HTTPS.
  • Restrict access further by IP address or firewall rule when appropriate.
  • Do not publish server-status information openly on a production server.

Common Issues and Solutions

Statistics page returns 404Check the configured Location path, URL context, saved configuration, and Apache restart.
Statistics page returns 403Review the authentication settings, access rules, and password-file permissions.
Valid credentials are rejectedVerify the username entry, password hash, and AuthUserFile path.
Apache fails to restartValidate the Location block and authentication directive syntax.
Statistics page is publicly accessibleAdd Basic authentication and restrict access through HTTPS, IP rules, or firewall settings.