I know this is a stupid question, but I could not find the Information anywhere. I am maintaining a website for an old client and up until now I used the X-SENDFILE header to control the Access to a rather large file.

His Server administrators now updated Apache which broke the website. After doing some research I found out, that I had to remove the XSendFileAllowAbove Option and instead add XSendFilePath. Since this option apparently can not be set in the .htaccess file (I read about that, I also tried it to be sure) the server administrators have to add it directly. However, they refuse to do that and say that mod_xsendfile is deprecated. I searched to verify that but can not find it anywhere.

Also, they refuse to suggest an alternative, so if you guys know for any I¨d be thankful :).

The file is too large to be served with PHP (at least not easily), I have no access to the server, I can only access the website code.


As soon as I posted the question I found this post, which seems to at least suggest that mod_xsendfile is working perfectly well in Apache 2.4: https://superuser.com/questions/1035459/is-mod-xsendfile-not-compatible-with-apache-2-4 This does not answer my question completely, but at least it's a start and may help someone searching for the same and finding this question.


Deprecated here doesn't mean it won't work with Apache 2.4, but that it's against their own policy of quality software. After all, mod_xsendfile:

  • is not a standard Apache module officially supported.
  • needs to be compiled separately; not in any repository.
  • was originally designed for Apache 2 & 2.2.
  • hasn't been maintained since 2011; for 6 years.

Although the module is simple, using that kind of module may expose the system to security threats. Therefore, the limitation seems reasonable, and you definitely wouldn't get the module on any shared hosting, either.

Hopefully someone here can suggest alternative solutions!


the "latest" 1.0 version of x-sendfile works on apache 2.4. i just had to update all my servers to 1.0 from 0.6 after continuous dropped connections. the 1.0 version fixes the dropped connections problem.



You can use the build-in directive so no need to the extra module


  • The built in directive does not do the same thing as the old module. Oct 16 '20 at 20:36
  • @MichaelHampton what is the difference? Oct 16 '20 at 20:56
  • The built in directive applies only to static files. The old module uses sendfile at the direction of an upstream web application. Oct 16 '20 at 21:00
  • @MichaelHampton I'm not sure if I get what you are trying to say. can you clarify what would be the practical difference? Oct 16 '20 at 21:29
  • Did you read the documentation of the module? Oct 16 '20 at 21:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.