Understanding mod_headers in Apache – Configuration and Troubleshooting

Contents: What is mod_headers? Check if mod_headers is Enabled Enable mod_headers in Apache Using mod_headers in Apache Configuration Debugging mod_headers Issues Summary of Fixes

What is mod_headers?

mod_headers is an Apache module that allows you to modify HTTP response headers. This is useful for:

Security headers (e.g., Content-Security-Policy, Strict-Transport-Security).
CORS (Cross-Origin Resource Sharing) settings.
Custom headers for API responses.
Controlling browser caching.

Check if mod_headers is Enabled

To verify if mod_headers is enabled, run:

apachectl -M | grep headers

Expected output:

headers_module (shared)

If you do not see headers_module, enable it.

Enable mod_headers in Apache

For Debian/Ubuntu

Run:

sudo a2enmod headers
sudo systemctl restart apache2

For CentOS/RHEL

Make sure mod_headers is loaded in Apache's configuration file:

sudo nano /etc/httpd/conf/httpd.conf

Find or add:

LoadModule headers_module modules/mod_headers.so

Restart Apache:

sudo systemctl restart httpd

Using mod_headers in Apache Configuration

Adding Security Headers

To add security headers globally, edit your Apache configuration file:

sudo nano /etc/apache2/sites-available/000-default.conf

Add inside the <VirtualHost> block:

<IfModule mod_headers.c>
    Header always set X-Frame-Options "DENY"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
</IfModule>

Restart Apache:

sudo systemctl restart apache2

Enable CORS (Cross-Origin Resource Sharing)

To allow CORS for a domain:

Header set Access-Control-Allow-Origin "https://example.com"
Header set Access-Control-Allow-Methods "GET, POST, OPTIONS"
Header set Access-Control-Allow-Headers "Content-Type"

Modify Cache-Control Headers

Header set Cache-Control "no-store, no-cache, must-revalidate, max-age=0"

Debugging mod_headers Issues

Check if Headers Are Applied

Use curl:

curl -I http://yourdomain.com

Expected output:

X-Frame-Options: DENY
X-Content-Type-Options: nosniff

Check Apache Logs for Errors

sudo tail -f /var/log/apache2/error.log

Ensure No Conflicting Rules in .htaccess

Check .htaccess:

sudo nano /var/www/html/.htaccess

Remove conflicting Header directives.

Summary of Fixes

Issue	Fix
mod_headers not enabled	`sudo a2enmod headers` (Debian) or `LoadModule headers_module` (CentOS)
Headers not appearing in response	Check .htaccess or Apache config for conflicts
Changes not applying	Restart Apache: `sudo systemctl restart apache2`
Debug headers	Use `curl -I http://yourdomain.com`

By enabling and configuring mod_headers, you can secure your Apache server, enable CORS, and control HTTP responses effectively.

Understanding mod_headers in Apache – Configuration and Troubleshooting

What is mod_headers?

Check if mod_headers is Enabled

Enable mod_headers in Apache

For Debian/Ubuntu

For CentOS/RHEL

Using mod_headers in Apache Configuration

Adding Security Headers

Enable CORS (Cross-Origin Resource Sharing)

Modify Cache-Control Headers

Debugging mod_headers Issues

Check if Headers Are Applied

Check Apache Logs for Errors

Ensure No Conflicting Rules in .htaccess

Summary of Fixes

High-Availability Cloud VDS

Hosting

Cloud Solution

For You

VDS

Website Builders

Our services

Client Area

Select Currency

Understanding mod_headers in Apache – Configuration and Troubleshooting

What is mod_headers?

Check if mod_headers is Enabled

Enable mod_headers in Apache

For Debian/Ubuntu

For CentOS/RHEL

Using mod_headers in Apache Configuration

Adding Security Headers

Enable CORS (Cross-Origin Resource Sharing)

Modify Cache-Control Headers

Debugging mod_headers Issues

Check if Headers Are Applied

Check Apache Logs for Errors

Ensure No Conflicting Rules in .htaccess

Summary of Fixes

High-Availability Cloud VDS

Hosting

Cloud Solution

For You

VDS

Website Builders

Our services

Client Area

Выберите валюту