Apache 129 began in February 1995 as eight webmasters' patches to the stalled NCSA httpd, and by 1996 Netcraft 11,321 ranked it the most used server on the Internet. Its lasting strength is per-directory configuration: .htaccess lets whoever owns a directory change rewriting, authentication and headers without root access or a restart, which is why shared hosting, WordPress 48 and Laravel 2,157 depend on it. Its costs are the .htaccess lookup on every request (The Directory Walk Cost), a process per connection under the prefork MPM (MPMs and Workers), and no HTTP/3, which nginx 75 and Caddy 7,400 ship (Apache vs nginx).
W3Techs 13,241 puts Apache on 22.0% of websites whose server is known (23 September 2026), behind Cloudflare 2 Server and nginx at 30.9% each and ahead of LiteSpeed 17,276 at 14.5%, a commercial server that also reads .htaccess. The survey reads the Server header, so sites behind Cloudflare's proxy count as Cloudflare whatever their origin runs.
Upstream's current release is Apache httpd 2.4.68 (8 June 2026); 2.4 is the only supported branch. Ubuntu 26.04 225 LTS ships 2.4.66 as 2.4.66-2ubuntu2.4 (6 July 2026), whose changelog backports all thirteen CVE fixes of 2.4.68, including CVE-2026-44119, a privilege escalation through .htaccess expressions. Judge a package by its changelog, not its version string; every output in this chapter comes from the Ubuntu build.