How Apache ServerName and ServerAlias select a virtual host

Understand Apache virtual-host matching, default-host order, wildcard aliases, and the separate roles of TLS SNI and HTTP Host.

Guance Editorial Team 2026-10-27 3 min read Updated 2026-10-27

Best practices

ServerName gives a virtual host its primary name. ServerAlias adds other names that should use the same configuration. Apache first selects candidates by the connection's local IP address and port, then uses the request hostname to choose among those candidates.

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com blog.example.com
    DocumentRoot /var/www/example
</VirtualHost>

<VirtualHost *:80>
    ServerName shop.example.com
    DocumentRoot /var/www/shop
</VirtualHost>

Here, the apex, www, and blog use one document root, while shop uses another. Adding an alias does not create a DNS record or redirect a browser to the primary name. Configure DNS and any canonical-host redirects separately.

Understand match order

Within the applicable IP/port group, the first virtual host whose ServerName or ServerAlias matches wins. If no name matches, Apache uses the first virtual host in that group. Requests to an IP address or an unexpected hostname can therefore reach the default site.

An exact name in a later virtual host does not automatically outrank a wildcard that already matched an earlier one. Inspect the effective configuration order instead of relying on filenames alone.

ServerAlias *.example.com example.*

Apache's hostname wildcard matching is distinct from DNS wildcard synthesis and TLS certificate matching. In particular, do not use a broad Apache alias as evidence that a certificate covers every matching name.

Make the default host explicit

Place a rejecting virtual host before the public sites in the relevant address group:

<VirtualHost *:80>
    ServerName default.invalid
    <Location "/">
        Require all denied
    </Location>
</VirtualHost>

This example covers HTTP on port 80. HTTPS needs an appropriate default TLS configuration as well. On Debian-style installations, included sites-enabled files are commonly loaded in filename order, but apachectl -S is the useful view of the assembled configuration.

apachectl -S
apachectl configtest
sudo systemctl reload apache2

Use the service name for your distribution. Test each primary name and alias, including www, plus an unexpected Host value. Omitting www often explains why that hostname serves the wrong site.

Account for HTTPS

TLS happens before the HTTP request. The client's SNI value can select the virtual host and certificate during the handshake; the HTTP Host field then participates in request routing. A certificate must cover the hostname the client validates. Without SNI, the first TLS virtual host for the address group commonly supplies the initial TLS configuration. Mismatched SNI and Host values can also encounter protocol or security checks.

Use aliases when domains should share document roots, logs, and rewrite rules. Use separate virtual hosts when their behavior differs. An IP address can be a ServerName, but a deliberate default host is often clearer for controlling direct-IP requests.

For diagnosis, log the supplied Host with %{Host}i and the serving virtual host with %v. DataKit log collection can retain both fields so you can identify requests that reached the default host.