How to Troubleshoot Apache: A Step-by-Step Checklist

When a website on Apache will not load, I work through these checks in order, from the outside in. The commands are for Red Hat-family systems (CentOS, Rocky Linux, AlmaLinux), where Apache is called httpd. Debian and Ubuntu differences are noted where they matter.

Before you start

Run the commands as root (or with sudo).
Note exactly what the browser shows (a timeout, “connection refused”, an error code such as 403 or 500). It points to which check will find the problem.

The checklist

If you are accessing the website by name, make sure it resolves to an IP address by pinging the address:
Terminal window
```
ping -c 4 www.example.com
```
The first line shows the IP address the name resolves to. Check it is your server’s address. If the name does not resolve, the problem is DNS, not Apache. A server may block ping replies, so “no reply” with the correct IP address is not necessarily a fault. You can look up the address without ping:
Terminal window
```
getent hosts www.example.com
```
Check the status of Apache: is it running?
Terminal window
```
systemctl status httpd
```
Look for active (running). If it shows failed, the last log lines in the output often say why. On older systems without systemd (CentOS 6 and earlier) use service httpd status. On Debian and Ubuntu the service is called apache2: systemctl status apache2.
Check for any syntax error in the Apache configuration if it is not running or is failing to restart:
Terminal window
```
httpd -t
```
The same check is also available as:
Terminal window
```
apachectl configtest
```
Both should print Syntax OK. If there is an error, the output names the file and line number. On Debian and Ubuntu, use apachectl configtest (or apache2ctl configtest).
If the service is failing to start and the syntax check gives little information, check the Apache logs:
Terminal window
```
tail -n 50 /var/log/httpd/error_log
tail -n 50 /var/log/httpd/ssl_error.log
```
On CentOS the SSL error log created by the stock ssl.conf is usually named ssl_error_log (with an underscore, not .log). List the folder to see the exact names on your server:
Terminal window
```
ls /var/log/httpd/
```
On Debian and Ubuntu the logs are in /var/log/apache2/ (the main one is /var/log/apache2/error.log). On systemd systems you can also see start-up errors with:
Terminal window
```
journalctl -u httpd -n 50
```
To watch the log while you reload the page in a browser, use tail -f /var/log/httpd/error_log and press Ctrl+C to stop.
Check that Apache is listening on the HTTP or HTTPS port, whichever the service is supposed to listen on (80 for HTTP, 443 for HTTPS):
Terminal window
```
netstat -tupan | grep -i httpd
```
-t and -u show TCP and UDP, -p shows the program using each port, -a shows all sockets and -n shows numbers instead of names. On newer systems netstat may not be installed (it is in the net-tools package); ss does the same job:
Terminal window
```
ss -tlnp | grep -E ':80|:443'
```
If nothing is listening, check the Listen lines in the configuration. If another program is using the port, Apache cannot start on it, and the error log says so.
Make sure the firewall is configured to allow access to the service ports. My original note said to make sure the firewall is not running. Turning the firewall off is useful only as a short test; the proper fix is to open the ports. On Rocky Linux, AlmaLinux and CentOS 7 (firewalld):
Terminal window
```
sudo firewall-cmd --list-all
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
```
On Ubuntu with ufw, check with sudo ufw status. Also check any firewall outside the server, such as a cloud provider’s security group.
Make sure SELinux is configured to allow httpd to run. My original note also said “make sure SELinux is turned off”. As with the firewall, switching SELinux to permissive mode can confirm whether it is the cause, but leaving it disabled removes a security layer. Check the mode:
Terminal window
```
getenforce
```
To test, switch to permissive mode temporarily (until the next reboot):
Terminal window
```
sudo setenforce 0
```
If the site then works, SELinux was blocking something. Switch it back on with sudo setenforce 1 and fix the cause. A common one is website files in a non-standard folder without the right SELinux label; files under /var/www/ get the correct label by default. Denials are logged in /var/log/audit/audit.log. SELinux is used on Red Hat-family systems; Debian and Ubuntu do not use it by default.

Notes for today

The list above follows my original order (the original numbering had two step 2s and two step 3s, which I have fixed). Steps 2 to 4 are the ones that solve most “Apache will not start” problems; steps 5 to 7 cover “Apache is running but the site will not load”.
After fixing a config problem, run apachectl configtest before restarting, then systemctl restart httpd. For config changes on a busy site, systemctl reload httpd applies them without dropping current connections.
Apache’s official documentation is at https://httpd.apache.org/docs/.