What Varnish does

Varnish Cache is a reverse proxy that keeps copies of pages in memory. The first visitor’s request goes to the web server. Later visitors get the stored copy straight from memory, without PHP or the database doing any work. For busy sites with pages that are the same for most visitors, such as blogs, news sites and catalogs, this cuts server load and speeds up response times a great deal.

Varnish is less useful for pages that are different for each visitor, such as carts, checkouts and account pages. Those must bypass the cache.

A note on the name

In 2025 the open-source Varnish Cache project was renamed Vinyl Cache, while Varnish Software continues to publish Varnish Cache. Most Linux distributions still ship the package as varnish, and the commands and configuration in this guide are the same.

How the pieces fit together

Apache only listens on 127.0.0.1, so visitors cannot reach it directly.

Requirements

• ✓ A VPS or dedicated server with root access, running a supported release such as AlmaLinux 9, Rocky Linux 9 or Ubuntu 24.04.
• ✓ A working Apache and PHP site.
• ✓ Enough memory for the cache. Start with 256 MB to 1 GB for Varnish, depending on the size of your site.
• ✓ A plan for HTTPS, because Varnish does not handle TLS itself.

Step 1: install Varnish

# AlmaLinux, Rocky Linux
dnf install -y varnish

# Ubuntu and Debian
apt update && apt install -y varnish

varnishd -V

Distribution packages are older than the newest release but get security updates. If you need a newer version, use the official repositories listed on the project’s website.

Step 2: move Apache to port 8080

# AlmaLinux and Rocky Linux: /etc/httpd/conf/httpd.conf
Listen 127.0.0.1:8080

# Ubuntu and Debian: /etc/apache2/ports.conf
Listen 127.0.0.1:8080

Change <VirtualHost *:80> to <VirtualHost *:8080> in each site’s configuration, then restart Apache:

systemctl restart httpd      # AlmaLinux, Rocky Linux
systemctl restart apache2    # Ubuntu, Debian

Step 3: point Varnish at Apache

Edit /etc/varnish/default.vcl:

vcl 4.1;

backend default {
    .host = "127.0.0.1";
    .port = "8080";
}

sub vcl_recv {
    # Never cache admin, login, cart and checkout pages
    if (req.url ~ "^/(wp-admin|wp-login\.php|cart|checkout|my-account)") {
        return (pass);
    }
    # Never cache logged-in users
    if (req.http.Cookie ~ "wordpress_logged_in|woocommerce_items_in_cart") {
        return (pass);
    }
}

Adjust the paths and cookie names to your application. The example covers WordPress and WooCommerce.

Step 4: make Varnish listen on port 80

The listening port is set in the systemd service, and the packaged command differs between distributions. First look at it:

systemctl cat varnish | grep ExecStart

Then create an override, so package updates do not undo your change:

systemctl edit varnish

Add an empty ExecStart= line, which clears the original, then paste the original ExecStart line and change only -a :6081 to -a :80. Keep every other option, such as -F on Ubuntu. On AlmaLinux 9 the result looks like this:

[Service]
ExecStart=
ExecStart=/usr/sbin/varnishd -a :80 -f /etc/varnish/default.vcl -s malloc,512m

The -s malloc,512m option sets the cache size. Then start Varnish:

systemctl daemon-reload
systemctl enable --now varnish
ss -tlnp | grep -E ":80 |:8080 "

Step 5: add HTTPS in front

Install Nginx, give it your certificate, and pass requests to Varnish on port 80:

server {
    listen 443 ssl;
    server_name example.com www.example.com;
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:80;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

Our free SSL guide shows how to get the certificate. Make sure your application trusts the X-Forwarded-Proto header, or it may loop between HTTP and HTTPS.

Step 6: test the cache

curl -sI https://example.com/ | grep -iE "x-varnish|age|via"
curl -sI https://example.com/ | grep -iE "x-varnish|age|via"   # run twice

On the second request, Age should be above 0, and X-Varnish shows two numbers. That means the page came from the cache.

Monitor Varnish

Clear the cache after changes

After you publish content, old pages may stay in the cache until they expire. Ban everything, or install a purge plugin for your CMS, such as Proxy Cache Purge for WordPress:

varnishadm "ban req.url ~ /"

Set how long pages stay cached

Varnish follows the Cache-Control headers your application sends. If the application sends none, Varnish uses its default lifetime of two minutes. You can set your own lifetime, and a grace period that lets Varnish serve a slightly old page while it fetches a fresh one, or while Apache is down:

sub vcl_backend_response {
    if (beresp.ttl <= 0s) {
        set beresp.ttl = 5m;     # cache for 5 minutes when the app sets nothing
    }
    set beresp.grace = 1h;       # serve stale pages for up to 1 hour if needed
}

Reload Varnish after each VCL change with systemctl reload varnish. A reload keeps the cache.

Troubleshooting