How to Enable and Configure mod_headers in Apache

mod_headers is an Apache module that lets you modify HTTP response headers. This guide covers the full enable-and-configure cycle. For the install side and parallel modules, see How to Install and Enable mod_headers in Apache, Understanding mod_headers in Apache – Configuration and Troubleshooting, and How to Enable and Configure mod_expires in Apache for Caching.

What is mod_headers?

mod_headers is an Apache module that allows you to modify HTTP headers sent in the request and response. It is commonly used for:

• Security headers (e.g., Content-Security-Policy, Strict-Transport-Security)
• CORS (Cross-Origin Resource Sharing) configuration
• Custom headers for API responses
• Controlling browser caching

Check if mod_headers is Enabled

Run the following command:

apachectl -M | grep headers

Expected output:

headers_module (shared)

If mod_headers is not enabled, proceed to Step 2.

Enable mod_headers in Apache

For Debian/Ubuntu

Run:

sudo a2enmod headers
sudo systemctl restart apache2

For CentOS/RHEL

Ensure mod_headers is loaded in Apache's configuration file:

sudo nano /etc/httpd/conf/httpd.conf

Find or add:

LoadModule headers_module modules/mod_headers.so

Restart Apache:

sudo systemctl restart httpd

Configure mod_headers in Apache

You can now modify headers in Apache's virtual host configuration or .htaccess.

Add Security Headers

Edit your site's Apache configuration file:

sudo nano /etc/apache2/sites-available/000-default.conf

or

sudo nano /etc/httpd/conf/httpd.conf

Add inside the <VirtualHost> block:

<IfModule mod_headers.c>
    Header always set X-Frame-Options "DENY"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

Restart Apache:

sudo systemctl restart apache2

or

sudo systemctl restart httpd

Enable CORS (Cross-Origin Resource Sharing)

If your website needs to allow cross-origin requests:

Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Methods "GET, POST, OPTIONS"
Header set Access-Control-Allow-Headers "Content-Type"

For security, replace "*" with your domain instead of allowing all origins.

Modify Headers via .htaccess

If you cannot edit the main Apache configuration, you can enable headers in .htaccess.

Edit .htaccess File

sudo nano /var/www/html/.htaccess

Add:

<IfModule mod_headers.c>
    Header set X-Frame-Options "DENY"
    Header set X-Content-Type-Options "nosniff"
</IfModule>

Save and exit the file, then restart Apache.

Verify That mod_headers is Working

Check HTTP Headers

Run:

curl -I http://yourdomain.com

Expected output:

X-Frame-Options: DENY
X-Content-Type-Options: nosniff

Check Apache Logs for Errors

sudo tail -f /var/log/apache2/error.log

or for CentOS:

sudo tail -f /var/log/httpd/error_log

Summary of Fixes

By enabling and configuring mod_headers, you can improve security, enable CORS, and control HTTP responses effectively.