Each Apache process is using about 70MB of private/rss memory, so I would like to lean them up a bit. The server runs Magento and Wordpress only. PHP is run as fcgid.

Which modules would you consider safe to disable?

Loaded Modules:

core_module (static)

mpm_prefork_module (static)

http_module (static)

so_module (static)

auth_basic_module (shared)

auth_digest_module (shared)

authn_file_module (shared)

authn_alias_module (shared)

authn_anon_module (shared)

authn_dbm_module (shared)

authn_default_module (shared)

authz_host_module (shared)

authz_user_module (shared)

authz_owner_module (shared)

authz_groupfile_module (shared)

authz_dbm_module (shared)

authz_default_module (shared)

ldap_module (shared)

authnz_ldap_module (shared)

include_module (shared)

log_config_module (shared)

logio_module (shared)

env_module (shared)

ext_filter_module (shared)

mime_magic_module (shared)

expires_module (shared)

deflate_module (shared)

headers_module (shared)

usertrack_module (shared)

setenvif_module (shared)

mime_module (shared)

dav_module (shared)

status_module (shared)

autoindex_module (shared)

info_module (shared)

dav_fs_module (shared)

vhost_alias_module (shared)

negotiation_module (shared)

dir_module (shared)

actions_module (shared)

speling_module (shared)

userdir_module (shared)

alias_module (shared)

substitute_module (shared)

rewrite_module (shared)

proxy_module (shared)

proxy_balancer_module (shared)

proxy_ftp_module (shared)

proxy_http_module (shared)

proxy_ajp_module (shared)

proxy_connect_module (shared)

cache_module (shared)

suexec_module (shared)

disk_cache_module (shared)

cgi_module (shared)

version_module (shared)

sed_module (shared)

security2_module (shared)

unique_id_module (shared)

fcgid_module (shared)

evasive20_module (shared)

perl_module (shared)

php5_module (shared)

ssl_module (shared)

dav_svn_module (shared)

authz_svn_module (shared)

  • 5
    The ones you don't use. Jun 25, 2012 at 0:29
  • 1
    It's likely you don't actually use over half of those, but you'll probably have to disable one at a time and test to see if the site still works.
    – Chris S
    Jun 25, 2012 at 4:22
  • The better question would be "Which Apache modules are safe to enable?". As for security and performance reasons, you should always have only this enabled you really use and need. How to find out? Well, disable all and reenable them one at a time. Oct 27, 2014 at 9:27

3 Answers 3


Here is a webpage which details which Apache modules can be safely removed. He considers the most common use cases but you should always check afterwards and reenable what you do need:

This is the list of modules that the author left enabled:

core_module (static)
log_config_module (static)
logio_module (static)
version_module (static)
mpm_event_module (static)
http_module (static)
so_module (static)
auth_basic_module (shared)
authn_file_module (shared)
authz_host_module (shared)
authz_user_module (shared)
expires_module (shared)
deflate_module (shared)
headers_module (shared)
dir_module (shared)
mime_module (shared)
setenvif_module (shared)
rewrite_module (shared)
proxy_module (shared)
proxy_fcgi_module (shared)

The page contains details for CentOS and also Ubuntu server. I highly recommend reading the entire page as it contains details as to why certain packages were left or were disabled, as well as tips. Your use case is likely not exactly as the author's use case, so be sure to use discretion and proper judgement. And test!


I would disable these ones:


And maybe:


As mentioned though, check which ones you're actually using, and disable the others. If you disable them just by commenting the line in the config file, then you can easily re-enable them if something breaks without a certain module.

  • 1
    In addition, I would always disable every proxy module on any site by default, unless you specifically know you need it, because if you get it accidentally or maliciously configured, you're wide open to abuse. Jun 25, 2012 at 9:00
  • Thanks, I removed all of the recomended ones (and perl from the 2nd list). Still need ssl_module (i run magento) and I want autoindex functionality. But private memory is still around 70Mb per process...
    – Gaia
    Jun 26, 2012 at 17:19

I created a small python script to help you with it. Please have a look at https://github.com/zioalex/unused_apache_modules

This is what you can expect from it:

curl http://localhost/server-info > http_modules_test.txt
cat http_modules_test.txt| python find_unused_apache_mod.py

Module name mod_python.c
Configuration Phase Participation: 4
Request Phase Participation: 11
Current Configuration: 3

Module name mod_version.c
Configuration Phase Participation: 0
Request Phase Participation: 0
Current Configuration: 1

Module name mod_proxy_connect.c
Configuration Phase Participation: 0
Request Phase Participation: 0
Current Configuration: 0

To remove safely:
POPPED:  mod_proxy_connect.c

To KEEP:  ['mod_python.c', 'mod_version.c', 'mod_proxy_connect.c']

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.