Fixing Apache AH01328 “Line too long” with mod_substitute

TL;DR

When Apache’s mod_substitute processes very long single‑line payloads (common with WordPress’ admin-ajax.php and page builders like Elementor), it can error out with:

Fix by scoping your substitution filter and raising the line length limit with SubstituteMaxLineLength in a more specific <LocationMatch> for admin-ajax.php. In our case, a 100M limit resolved it.

Who is this for?

• WordPress admins using mod_substitute for URL rewrites/branding in responses.
• Plesk/virtual host maintainers seeing AH01328 in error logs.
• Anyone applying substitutions to text/html and JSON/JS/CSS where minified, single‑line responses are common.

Symptoms

• Editors intermittently fail to save or preview.
• AJAX actions (Elementor, WooCommerce, etc.) hang or error.
• Apache error log shows AH01328: Line too long for .../wp-admin/admin-ajax.php.

Why it happens (root cause)

mod_substitute works line‑by‑line. Minified assets or JSON responses can be a single, massive line that exceeds the module’s default maximum line length. When that happens, the filter aborts with AH01328.

The reliable fix

1. **Keep your broad substitutions in a parent **<Location> (or <Directory>), with a reasonable default line limit (e.g., 10–20 MB).
2. **Add a more specific <LocationMatch> for **admin-ajax.php and set a larger limit only there. This contains the risk and memory footprint.

Example configuration

Place the LocationMatch after your broader /blog/ location so the more specific block takes precedence.

Notes:

• Use explicit positive sizes (k, M, G suffixes allowed). Empirically, setting 0 may be ignored depending on build/version; prefer a concrete size like 100M for the AJAX endpoint.
• Apache applies the most specific matching section. The LocationMatch above overrides the parent /blog/ block.

Plesk specifics

• Put stanzas under the domain’s Apache & nginx Settings → Additional Apache directives, or in /var/www/vhosts/system/<domain>/conf/vhost.conf.
• After editing files under .../conf/, run:
  
  plesk repair web -y

  1 2	plesk repair web -y

  
  or reload Apache via systemd.

Verifying the change

1. Config test
   
   apachectl -t

   1 2	apachectl -t

2. Reload
   
   systemctl reload httpd # RHEL/CentOS/AlmaLinux # or systemctl reload apache2 # Debian/Ubuntu

   1 2 3 4

   systemctl reload httpd    # RHEL/CentOS/AlmaLinux # or systemctl reload apache2  # Debian/Ubuntu

3. Hit the endpoint while tailing logs:
   
   tail -f /var/log/httpd/error_log # path may vary (/var/log/apache2/error.log)

   1 2	tail -f /var/log/httpd/error_log    # path may vary (/var/log/apache2/error.log)

4. Optional: temporarily raise verbosity to trace substitutions:
   
   LogLevel core:info substitute:trace1

   1 2	LogLevel core:info substitute:trace1

Safety & performance considerations

• Scope narrowly. Large line limits increase per‑request memory usage. Keep big limits only on endpoints that need them.
• Filter only needed types. If you don’t need to rewrite JSON/JS/CSS, restrict to text/html to avoid massive single‑line payloads.
• Consider q flag on Substitute rules (e.g., ...|iq) when rules are independent; this can avoid extra bucket merges and reduce CPU overhead.

Alternatives & fallbacks (if you still see errors)

• Raise the AJAX limit further (e.g., 200M) if you can reproduce payloads exceeding 100 MB.
• Split your substitutions: apply one set to HTML, and only the specific rule(s) required for JSON/JS in a separate, more targeted <Location>.
• Move heavy rewrites upstream (app‑level output buffering or CDN/edge workers) if transformations are complex.

Appendix: Useful commands

Have questions or want us to review your vhost? Reach out to Reliable Penguin — we’re happy to help.