<p>I'm assuming mod_headers is installed &amp; active? Otherwhise I can't say why the .htaccess rules are not applied (devOps is not my forte) but you could set them through the twig template. </p>

<p>See <a href="https://craftcms.com/docs/templating/header" rel="nofollow noreferrer">here</a> for the tag to use. Basically it comes down to something like this (untested): </p>

<pre><code>{% header 'X-Xss-Protection "1; mode=block"' %}
{% header 'X-Content-Type-Options "nosniff' %}
{% header 'X-Frame-Options ALLOWALL' %}
{% header 'Strict-Transport-Security "max-age=31536000"' %}
{% header 'Referrer-Policy no-referrer' %}
</code></pre>

<p>You can make those in a block and just include the block on all the relevant pages. </p>

CC BY-SA 3.0
2017-07-17T09:31:44.453Z
2017-07-17T09:31:44.453Z
mrsmn
<p>This is more of a server config issue than a Craft one.</p>

<p>Craft does set a <a href="https://github.com/pixelandtonic/Craft-Release/blob/master/app/etc/web/WebApp.php#L181-L186" rel="nofollow noreferrer">few of those headers from PHP</a>, but only for Control Panel requests.  It's completely hands-off on the front-end of your site assuming that you'll set whatever headers you want.</p>

<p>As <a href="https://craftcms.stackexchange.com/a/21223/57">Michael said</a>, make sure that mod_headers is installed and make sure that nothing else in your <code>.htaccess</code> or any other <code>.htaccess</code> files are interfering. I'd also make sure that something like mod_security or Suhosin is also not interfering.</p>

CC BY-SA 3.0
2017-07-17T17:21:01.623Z
2017-07-17T17:21:01.623Z
Brad Bell
<p>For Apache 2.4, please configure in httpd.conf without mod_headers</p>

<p>
.
.
.
</p>

CC BY-SA 4.0
2020-02-09T02:10:33.713Z
Welcome to the Craft CMS Stack Exchange, SFA! Would you mind elaborating on your answer? It seems like you're recommending a solution that would come with significant drawbacks, but it's hard to tell without any justification for why this should be considered.
Matt Stein
CC BY-SA 4.0
2020-02-07T10:56:26.543Z
2020-02-07T10:56:26.543Z
SFA
<p>We have an issue on our server when our Security Headers are not working. We added the following to our htaccess file after installing Craft CMS: -</p>

<pre><code>&lt;IfModule mod_headers.c&gt;
    Header always set X-Xss-Protection "1; mode=block"
    Header always set X-Content-Type-Options "nosniff"
    Header always append X-Frame-Options ALLOWALL
    Header always set Strict-Transport-Security "max-age=31536000"
    Header always set Referrer-Policy no-referrer
&lt;/IfModule&gt;
</code></pre>

<p>These settings worked on our previous CMS which was completely developed in house. We have recently upgraded our server to PHP 7 and Apache 2.4. We have been using <a href="https://securityheaders.io" rel="nofollow noreferrer">https://securityheaders.io</a> to check our results.</p>

<p>Any help trying to get this to work would be really appreciated.</p>

<php><htaccess><security>
Security Headers in htaccess Don't Work
# Security Headers in htaccess Don't Work

(Asked by: username_0 on 2017-07-17)

We have an issue on our server when our Security Headers are not working. We added the following to our htaccess file after installing Craft CMS: -

    Header always set X-Xss-Protection "1; mode=block"
    Header always set X-Content-Type-Options "nosniff"
    Header always append X-Frame-Options ALLOWALL
    Header always set Strict-Transport-Security "max-age=31536000"
    Header always set Referrer-Policy no-referrer


These settings worked on our previous CMS which was completely developed in house. We have recently upgraded our server to PHP 7 and Apache 2.4. We have been using https://securityheaders.io to check our results.
Any help trying to get this to work would be really appreciated.

**Tags:** php, htaccess, security

---

## 3 answers

### Answer by username_1 on 2017-07-17. Score: 2

I'm assuming mod_headers is installed & active? Otherwhise I can't say why the .htaccess rules are not applied (devOps is not my forte) but you could set them through the twig template. 
See here for the tag to use. Basically it comes down to something like this (untested): 
{% header 'X-Xss-Protection "1; mode=block"' %}
{% header 'X-Content-Type-Options "nosniff' %}
{% header 'X-Frame-Options ALLOWALL' %}
{% header 'Strict-Transport-Security "max-age=31536000"' %}
{% header 'Referrer-Policy no-referrer' %}

You can make those in a block and just include the block on all the relevant pages.


---

### Answer by username_2 on 2017-07-17. Score: 1

This is more of a server config issue than a Craft one.

Craft does set a [few of those headers from PHP](https://github.com/pixelandtonic/Craft-Release/blob/master/app/etc/web/WebApp.php#L181-L186), but only for Control Panel requests. It's completely hands-off on the front-end of your site assuming that you'll set whatever headers you want.

As [Michael said](https://craftcms.stackexchange.com/a/21223/57), make sure that mod\_headers is installed and make sure that nothing else in your `.htaccess` or any other `.htaccess` files are interfering. I'd also make sure that something like mod\_security or Suhosin is also not interfering.


---

### Answer by username_3 on 2020-02-07. Score: -3

For Apache 2.4, please configure in httpd.conf without mod\_headers

.
.
.

> **Comments:**
> **username_4**: Welcome to the Craft CMS Stack Exchange, SFA! Would you mind elaborating on your answer? It seems like you're recommending a solution that would come with significant drawbacks, but it's hard to tell without any justification for why this should be considered.  

---

