<p>As far as I know Craft does not set that header automatically, so I'm guessing you are either looking at stale cache or your are behind a proxy like Cloudflare that is setting it.</p>

CC BY-SA 4.0
2024-05-16T15:57:09.360Z
2024-05-16T15:57:09.360Z
Seth Warburton
<p>I'm trying to disable the X-Rewrite-URL header from my Craft CMS site. I have already tried disabling it via the secureHeaders setting in the general settings, but it still doesn't work.</p>
<p>Remove 'X-Rewrite-Url' from the secureHeaders configuration in my config/general.php file as follows:</p>
<pre><code>'secureHeaders' =&gt; [
            'X-Forwarded-For',
            'X-Forwarded-Host',
            'X-Forwarded-Proto',
            'X-Forwarded-Port',
            'Front-End-Https',
            'X-Original-Host',
        ], 
</code></pre>
<p>Despite these steps, the X-Rewrite-URL header is still being sent.</p>
<p>Has anyone else encountered this issue or have any suggestions on how to completely disable this header in Craft CMS? Any help would be greatly appreciated!</p>

<craft3><security><headers>
How to disable X-Rewrite-URL Header in Craft CMS 3?
# How to disable X-Rewrite-URL Header in Craft CMS 3?

(Asked by: username_0 on 2024-05-15)

I'm trying to disable the X-Rewrite-URL header from my Craft CMS site. I have already tried disabling it via the secureHeaders setting in the general settings, but it still doesn't work.
Remove 'X-Rewrite-Url' from the secureHeaders configuration in my config/general.php file as follows:
'secureHeaders' => [
            'X-Forwarded-For',
            'X-Forwarded-Host',
            'X-Forwarded-Proto',
            'X-Forwarded-Port',
            'Front-End-Https',
            'X-Original-Host',
        ], 

Despite these steps, the X-Rewrite-URL header is still being sent.
Has anyone else encountered this issue or have any suggestions on how to completely disable this header in Craft CMS? Any help would be greatly appreciated!

**Tags:** craft3, security, headers


---

## 1 answers

### Answer by username_1 on 2024-05-16. Score: 1

As far as I know Craft does not set that header automatically, so I'm guessing you are either looking at stale cache or your are behind a proxy like Cloudflare that is setting it.


---

