Offensive Security Researcher & Quantum Cryptography Analyst

How to Configure Apache to Use a Different Port

Abdul Wahab Junaid
How to configure Apache to use a different port

How to configure Apache to use a different port

Apache listens on port 80 and 443 by default, but I’ve had plenty of good reasons to run it somewhere else: multiple sites on distinct ports on the same box, avoiding a conflict with another service, exposing a staging environment on a non-standard port, or sitting Apache behind a reverse proxy that owns the standard ports itself.

Here’s how I change Apache’s listening port, plus the firewall and SELinux steps that are easy to forget.

Why I Change Apache’s Port

Prerequisites

Step 1: Update the Listen Directive

The Listen directive tells Apache which port(s) to bind to, independent of any specific virtual host.

Debian/Ubuntu: I edit /etc/apache2/ports.conf

RHEL/CentOS: I edit /etc/httpd/conf/httpd.conf

Listen 8080

To keep 80 and add 8080 simultaneously:

Listen 80
Listen 8080

To bind a port to a specific IP only:

Listen 192.168.1.10:8080

Step 2: Update the Virtual Host to Match

Every <VirtualHost> block has to specify the exact IP:port combination it should respond to, matching a Listen directive:

<VirtualHost *:8080>
    ServerName example.com
    DocumentRoot /var/www/html

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

If there’s a Listen directive but no matching <VirtualHost *:port> block, Apache accepts connections on that port but serves the wrong site — or the default one.

Step 3: Test and Restart

sudo apachectl configtest
sudo systemctl restart apache2

A restart, not just a reload, is required for Listen changes to actually take effect, since it involves binding to a new socket.

Step 4: Open the New Port in the Firewall

I’ve got a full post on this; the short version:

# firewalld
sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

# ufw
sudo ufw allow 8080/tcp

Step 5: SELinux Considerations (RHEL/CentOS/Fedora)

With SELinux enforcing, Apache can only bind to a predefined set of ports by default (80, 443, 8080, 8443, a few others). Binding to something outside that list fails even with correct firewall rules — I’ve been caught by this more than once.

I check currently permitted ports:

sudo semanage port -l | grep http_port_t

If my chosen port isn’t listed, I add it:

sudo semanage port -a -t http_port_t -p tcp 9090

If the port was already assigned to a different SELinux type, I use -m (modify) instead of -a (add).

Step 6: Verify

sudo ss -tulnp | grep apache2
curl -I http://localhost:8080/

From another machine, once firewall rules are confirmed:

curl -I http://your-server-ip:8080/

Running Apache on Ports Below 1024 as a Non-Root User

Ports under 1024 are “privileged” on Linux and normally need root to bind. Apache’s master process typically starts as root specifically to bind 80/443, then drops privileges to a less-privileged worker user (www-data/apache) for handling requests — that’s already handled automatically by the standard startup scripts, so I don’t need to do anything special for standard ports.

If I’m deliberately running Apache entirely as a non-root user (like in a container) and need it to bind below 1024, I use setcap on the httpd binary, or more often, I just use a port above 1024 and put a reverse proxy in front that forwards from port 80.

Real-World Use Cases

Mistakes I’ve Made

Security Best Practices

Performance Considerations

Troubleshooting

Apache fails to start after changing Listen port I check the systemd journal for the specific error:

sudo journalctl -u apache2 -n 50

Common causes: the port’s already in use by another process, or (on RHEL-based systems) SELinux is blocking the bind.

curl works locally but not from another machine Almost always a firewall issue — I confirm the new port is explicitly allowed both on the host firewall and any cloud provider security group.

Wrong site/content served on the new port I confirm a <VirtualHost *:PORT> block exists matching the new port exactly; Apache falls back to the first matching virtual host if there’s no exact match.

FAQs

Can Apache listen on multiple ports at once? Yes — multiple Listen directives and a matching <VirtualHost> block for each port/IP combination I want to serve.

Does changing the port affect existing URLs or bookmarks? Yes — visitors need the new port explicit in the URL (like http://example.com:8080/) unless a reverse proxy or redirect maps the standard port to the new one transparently.

Is it safe to run a production site on a non-standard port permanently? Technically yes, but it adds friction for users who expect standard ports and complicates certificate/firewall management. I mostly use it internally, or behind a reverse proxy that presents the standard ports externally.

Summary and Key Takeaways

References

Exit mobile version