Apache XSendFile lets PHP authorize a request and then ask Apache to send the file efficiently. It is useful with SecureVideosDirectory and local files; it is not mandatory for every AVideo deployment and does not configure Nginx, CDN or object storage.

• Back up the active virtual-host configuration.
• Identify the real AVideo and media paths, including the target of any symbolic link.
• Confirm the site actually runs on Apache.
• Keep an SSH session open and know how to restore the previous configuration.

In the applicable HTTPS virtual host, enable XSendFile and allow only the real directory containing media. The block you will add looks like this, with your real path in both places:

<Directory /var/www/html/AVideo/videos>
    Options -Indexes
    AllowOverride All
    Require all granted
    XSendFile on
    XSendFilePath /var/www/html/AVideo/videos
</Directory>

If videos/ is a link to /mnt/avideo-data/videos, authorize the real target path. Do not set XSendFilePath to the whole application or filesystem, and do not enable directory listing.

Install and enable the module:

sudo apt update
sudo apt install -y libapache2-mod-xsendfile
sudo a2enmod xsendfile

Back up the active HTTPS virtual-host file and open it. Replace the example filename with the one used by your site:

sudo cp /etc/apache2/sites-available/video.example.com.conf /etc/apache2/sites-available/video.example.com.conf.before-xsendfile
sudo nano /etc/apache2/sites-available/video.example.com.conf

Add the <Directory> block shown above, using the real media path in both places. Then validate and reload Apache:

sudo apachectl configtest && sudo systemctl reload apache2
sudo apachectl -M | grep -i xsendfile

If validation fails, Apache is not reloaded. Correct the reported file and line, or restore the backup made before editing.

Configure SecureVideosDirectory, then test:

1. a public video through the normal AVideo player;
2. a protected video as an authorized user;
3. the same video while signed out;
4. seeking/range requests and downloads according to your policy;
5. a file on the moved disk, if applicable.

A direct test URL returning a blank page is not a reliable module test. Use browser Network details and Apache/AVideo logs to check status, headers and authorization behavior.

If you use SecureVideosDirectory, test protected playback from the plugin controls as well.

403: check the real path, Apache directory access, service-account read permission and plugin authorization.

Header is ignored: confirm the module is loaded with apachectl -M | grep xsendfile and that the directive is in the active virtual host.

Works until the disk moves: update the trusted real path and verify the disk mounts before Apache starts.

Using Nginx: these directives do nothing; configure the supported internal-redirect method for that server instead.