How to Enable and Configure mod_headers in Apache

Contents: What is mod_headers? Check if mod_headers is Enabled Enable mod_headers in Apache Configure mod_headers in Apache Enable CORS (Cross-Origin Resource Sharing) Modify Headers via .htaccess Verify That mod_headers is Working Summary of Fixes

What is mod_headers?

mod_headers is an Apache module that allows you to modify HTTP headers sent in the request and response. It is commonly used for:

Security headers (e.g., Content-Security-Policy, Strict-Transport-Security)
CORS (Cross-Origin Resource Sharing) configuration
Custom headers for API responses
Controlling browser caching

Check if mod_headers is Enabled

Run the following command:

apachectl -M | grep headers

Expected output:

headers_module (shared)

If mod_headers is not enabled, proceed to Step 2.

Enable mod_headers in Apache

For Debian/Ubuntu

Run:

sudo a2enmod headers
sudo systemctl restart apache2

For CentOS/RHEL

Ensure mod_headers is loaded in Apache's configuration file:

sudo nano /etc/httpd/conf/httpd.conf

Find or add:

LoadModule headers_module modules/mod_headers.so

Restart Apache:

sudo systemctl restart httpd

Configure mod_headers in Apache

You can now modify headers in Apache's virtual host configuration or .htaccess.

Add Security Headers

Edit your site's Apache configuration file:

sudo nano /etc/apache2/sites-available/000-default.conf

sudo nano /etc/httpd/conf/httpd.conf

Add inside the <VirtualHost> block:

<IfModule mod_headers.c>
    Header always set X-Frame-Options "DENY"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

Restart Apache:

sudo systemctl restart apache2

sudo systemctl restart httpd

Enable CORS (Cross-Origin Resource Sharing)

If your website needs to allow cross-origin requests:

Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Methods "GET, POST, OPTIONS"
Header set Access-Control-Allow-Headers "Content-Type"

For security, replace "*" with your domain instead of allowing all origins.

Modify Headers via .htaccess

If you cannot edit the main Apache configuration, you can enable headers in .htaccess.

Edit .htaccess File

sudo nano /var/www/html/.htaccess

Add:

<IfModule mod_headers.c>
    Header set X-Frame-Options "DENY"
    Header set X-Content-Type-Options "nosniff"
</IfModule>

Save and exit the file, then restart Apache.

Verify That mod_headers is Working

Check HTTP Headers

Run:

curl -I http://yourdomain.com

Expected output:

X-Frame-Options: DENY
X-Content-Type-Options: nosniff

Check Apache Logs for Errors

sudo tail -f /var/log/apache2/error.log

or for CentOS:

sudo tail -f /var/log/httpd/error_log

Summary of Fixes

Issue	Fix
mod_headers not enabled	`sudo a2enmod headers` (Debian) or `LoadModule headers_module` (CentOS)
Headers not appearing in response	Check .htaccess or Apache config for conflicts
Changes not applying	Restart Apache: `sudo systemctl restart apache2`
Debug headers	Use `curl -I http://yourdomain.com`

By enabling and configuring mod_headers, you can improve security, enable CORS, and control HTTP responses effectively.

How to Enable and Configure mod_headers in Apache

What is mod_headers?

Check if mod_headers is Enabled

Enable mod_headers in Apache

For Debian/Ubuntu

For CentOS/RHEL

Configure mod_headers in Apache

Add Security Headers

Enable CORS (Cross-Origin Resource Sharing)

Modify Headers via .htaccess

Edit .htaccess File

Verify That mod_headers is Working

Check HTTP Headers

Check Apache Logs for Errors

Summary of Fixes

High-Availability Cloud VDS

Hosting

Cloud Solution

For You

VDS

Website Builders

Our services

Client Area

Select Currency

How to Enable and Configure mod_headers in Apache

What is mod_headers?

Check if mod_headers is Enabled

Enable mod_headers in Apache

For Debian/Ubuntu

For CentOS/RHEL

Configure mod_headers in Apache

Add Security Headers

Enable CORS (Cross-Origin Resource Sharing)

Modify Headers via .htaccess

Edit .htaccess File

Verify That mod_headers is Working

Check HTTP Headers

Check Apache Logs for Errors

Summary of Fixes

High-Availability Cloud VDS

Hosting

Cloud Solution

For You

VDS

Website Builders

Our services

Client Area

Выберите валюту