Apache IP vs Name Based Virtual Hosting

Apache virtual hosting lets one web server serve multiple websites, and the two main methods are IP-based and name-based virtual hosting. IP-based virtual hosting uses a unique IP address for each site, while name-based virtual hosting uses the Host header in HTTP requests to route traffic to the correct site on a single IP address. This article explains how both methods work, when to use each, and how to configure them in Apache.

Background: Why Virtual Hosting Exists

In the early days of the web, each website had its own server and its own IP address. As the web grew, that became expensive and wasteful. Apache introduced virtual hosting in version 1.1 to let a single server process handle multiple domains. The HTTP/1.1 specification added the Host header, which browsers send with every request to indicate which domain they want. That header is the foundation of name-based virtual hosting.

IP-based virtual hosting predates that. It requires a separate IP address per site, either on the same server or on different servers behind a load balancer. Both methods are still used today, often in combination.

How Name-Based Virtual Hosting Works

With name-based virtual hosting, all sites share the same IP address and port (usually port 80 for HTTP and 443 for HTTPS). Apache reads the Host header from each incoming request and matches it against the ServerName and ServerAlias directives in its configuration. When a match is found, Apache serves the corresponding document root and settings.

Configuration example for two sites on one IP:

<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/example
</VirtualHost>

<VirtualHost *:80>
    ServerName example.org
    DocumentRoot /var/www/example_org
</VirtualHost>

The *:80 means Apache listens on all IP addresses on port 80. If a request arrives with a Host header that does not match any ServerName, Apache serves the first virtual host block as the default.

For HTTPS, name-based hosting works the same way, but the server must present a certificate that matches the requested domain. With SNI (Server Name Indication), the client sends the domain name during the TLS handshake, allowing Apache to select the correct certificate. Without SNI, all HTTPS sites on the same IP would need the same certificate.

How IP-Based Virtual Hosting Works

IP-based virtual hosting assigns a unique IP address to each website. Apache listens on each IP separately and serves the site bound to that address. The configuration uses the specific IP instead of a wildcard:

<VirtualHost 203.0.113.1:80>
    ServerName example.com
    DocumentRoot /var/www/example
</VirtualHost>

<VirtualHost 203.0.113.2:80>
    ServerName example.org
    DocumentRoot /var/www/example_org
</VirtualHost>

Each virtual host has its own IP, so Apache does not need the Host header to decide which site to serve. The IP address alone determines the site. This method works with any client, even very old ones that do not send a Host header, and it simplifies HTTPS certificate selection because each IP has only one certificate.

IP-based hosting is common in dedicated server environments, for SSL/TLS before SNI was widely supported, and for hosting services that require separate IPs for regulatory or operational reasons (e.g., separate SSL certificates for different brands).

How to Choose Between the Two

Most modern web hosting uses name-based virtual hosting because it is efficient and cheap. You can host hundreds of sites on a single IP address. However, there are cases where IP-based hosting is necessary or preferred:

Legacy clients: If you must support HTTP/1.0 clients that do not send a Host header, IP-based is the only option.
HTTPS without SNI: Very old browsers or operating systems may not support SNI. IP-based hosting avoids that limitation.
Separate IP for security or compliance: Some payment gateways or email services require a dedicated IP for reputation or firewall rules.
Wildcard certificates: If you need a single certificate covering multiple domains on the same IP, name-based is fine. But if you need distinct certificates per domain and cannot use SNI, IP-based is required.

For most new setups, name-based is the default. It is simpler to manage, does not require additional IP addresses (which cost money and are increasingly scarce with IPv4), and works with modern browsers and SNI.

Common Problems and Misconceptions

One common misconception is that name-based virtual hosting cannot work with HTTPS. That is false since SNI became standard. The real limitation is that all HTTPS sites on the same IP must have certificates that match their domains, and clients must support SNI. Modern browsers and operating systems do, but a few legacy clients (like some older Java applications) do not.

Another frequent issue is the ServerName mismatch. If you forget to set ServerName in a virtual host block, Apache uses the first block as the default, which can cause the wrong site to appear. Also, if you use ServerAlias incorrectly, you may serve a site for a domain you did not intend.

For IP-based hosting, a common problem is running out of IPv4 addresses. IPv4 addresses are scarce, and each site needs a unique one. IPv6 is a solution, but not all clients support it yet. Another issue is that IP-based hosting requires more configuration on the network side (routing, firewall, and DNS), and it does not scale as well as name-based.

Comparison: Name-Based vs IP-Based

IP usage: Name-based uses one IP for many sites; IP-based uses one IP per site.
HTTP/1.1 support: Name-based requires the Host header; IP-based does not.
HTTPS: Name-based needs SNI; IP-based works without SNI.
Configuration complexity: Name-based is simpler; IP-based requires more network setup.
Cost: Name-based is cheaper because IPs are free with most servers; IP-based may require purchasing additional IPs.
Scalability: Name-based scales to hundreds of sites; IP-based is limited by available IPs.
Use cases: Name-based is for general web hosting; IP-based is for legacy support, dedicated IPs, or special compliance.

Security and Performance Considerations

Security-wise, both methods are similar. The main difference is that IP-based hosting can isolate sites more cleanly at the network level, which can help with firewall rules. However, Apache runs all virtual hosts in the same process (unless you use separate processes or containers), so a vulnerability in one site can potentially affect others. Name-based hosting does not inherently increase risk, but you should keep Apache and all site code updated.

Performance is also similar. The Host header lookup is fast, and Apache handles thousands of name-based sites without a noticeable slowdown. The main performance factor is the number of concurrent connections and the server’s resources, not the hosting method.

One practical note: if you use name-based hosting with HTTPS, ensure that SNI is enabled in Apache (it is by default in modern versions). Also, use a single certificate that covers all your domains (a multi-domain or wildcard certificate) to avoid certificate errors.

Frequently Asked Questions

Can I mix IP-based and name-based virtual hosts on the same server? Yes, Apache allows you to have some virtual hosts bound to specific IPs and others to a wildcard. For example, you can have one IP-based host for a legacy site and several name-based hosts on another IP. Just ensure that no two virtual hosts use the same IP and port combination unless they have different ServerName values.

Does name-based virtual hosting work with HTTPS? Yes, as long as the client supports SNI (Server Name Indication). SNI is supported by all modern browsers and operating systems. The server must have a certificate that matches the requested domain. If you have multiple HTTPS sites on one IP, you need either a multi-domain certificate or SNI to select the right certificate.

What happens if a request comes in without a Host header? Apache will use the first virtual host block that matches the IP and port as the default. This can be a security concern if you want to reject such requests. You can set up a default virtual host that returns a 400 or 403 error, or redirects to a canonical domain.

How do I check which virtual host is being used for a request? You can check the Apache access logs, which record the Host header. You can also use the apachectl -S command (on Linux) to list all virtual hosts and their configurations. For a live request, you can use a tool like curl -H "Host: example.com" to simulate a specific host.

Is IP-based hosting more secure than name-based? Not inherently. The security difference is minimal. IP-based hosting allows you to separate sites at the network level, which can simplify firewall rules, but the web server software still runs in the same process. For strong isolation, you would use separate containers or virtual machines, regardless of the hosting method.

Can I use name-based hosting with IPv6? Yes, name-based hosting works with IPv6 exactly as with IPv4. You can use a wildcard *:80 or specify an IPv6 address like [2001:db8::1]:80. The Host header is the same, so there is no difference in configuration.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →