Answers.Body: <p>I'm assuming mod_headers is installed &amp; active? Otherwhise I can't say why the .htaccess rules are not applied (devOps is not my forte) but you could set them through the twig template. </p>
  
  <p>See <a href="https://craftcms.com/docs/templating/header" rel="nofollow noreferrer">here</a> for the tag to use. Basically it comes down to something like this (untested): </p>
  
  <pre><code>{% header 'X-Xss-Protection "1; mode=block"' %}
  {% header 'X-Content-Type-Options "nosniff' %}
  {% header 'X-Frame-Options ALLOWALL' %}
  {% header 'Strict-Transport-Security "max-age=31536000"' %}
  {% header 'Referrer-Policy no-referrer' %}
  </code></pre>
  
  <p>You can make those in a block and just include the block on all the relevant pages. </p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-07-17T09:31:44.453Z
Answers.LastActivityDate: 2017-07-17T09:31:44.453Z
Answers.UserDisplayName: mrsmn
Answers.Body: <p>This is more of a server config issue than a Craft one.</p>
  
  <p>Craft does set a <a href="https://github.com/pixelandtonic/Craft-Release/blob/master/app/etc/web/WebApp.php#L181-L186" rel="nofollow noreferrer">few of those headers from PHP</a>, but only for Control Panel requests.  It's completely hands-off on the front-end of your site assuming that you'll set whatever headers you want.</p>
  
  <p>As <a href="https://craftcms.stackexchange.com/a/21223/57">Michael said</a>, make sure that mod_headers is installed and make sure that nothing else in your <code>.htaccess</code> or any other <code>.htaccess</code> files are interfering. I'd also make sure that something like mod_security or Suhosin is also not interfering.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-07-17T17:21:01.623Z
Answers.LastActivityDate: 2017-07-17T17:21:01.623Z
Answers.UserDisplayName: Brad Bell
Answers.Body: <p>For Apache 2.4, please configure in httpd.conf without mod_headers</p>
  
  <p>
  .
  .
  .
  </p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-02-09T02:10:33.713Z
Answers.Text: Welcome to the Craft CMS Stack Exchange, SFA! Would you mind elaborating on your answer? It seems like you're recommending a solution that would come with significant drawbacks, but it's hard to tell without any justification for why this should be considered.
Answers.UserDisplayName: Matt Stein
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-02-07T10:56:26.543Z
Answers.LastActivityDate: 2020-02-07T10:56:26.543Z
Answers.UserDisplayName: SFA
Body: <p>We have an issue on our server when our Security Headers are not working. We added the following to our htaccess file after installing Craft CMS: -</p>
  
  <pre><code>&lt;IfModule mod_headers.c&gt;
      Header always set X-Xss-Protection "1; mode=block"
      Header always set X-Content-Type-Options "nosniff"
      Header always append X-Frame-Options ALLOWALL
      Header always set Strict-Transport-Security "max-age=31536000"
      Header always set Referrer-Policy no-referrer
  &lt;/IfModule&gt;
  </code></pre>
  
  <p>These settings worked on our previous CMS which was completely developed in house. We have recently upgraded our server to PHP 7 and Apache 2.4. We have been using <a href="https://securityheaders.io" rel="nofollow noreferrer">https://securityheaders.io</a> to check our results.</p>
  
  <p>Any help trying to get this to work would be really appreciated.</p>
  
Tags: <php><htaccess><security>
Title: Security Headers in htaccess Don't Work
ThreadText: # Security Headers in htaccess Don't Work
  
  (Asked by: username_0 on 2017-07-17)
  
  We have an issue on our server when our Security Headers are not working. We added the following to our htaccess file after installing Craft CMS: -
  
  ```
  <IfModule mod_headers.c>
      Header always set X-Xss-Protection "1; mode=block"
      Header always set X-Content-Type-Options "nosniff"
      Header always append X-Frame-Options ALLOWALL
      Header always set Strict-Transport-Security "max-age=31536000"
      Header always set Referrer-Policy no-referrer
  </IfModule>
  
  ```
  
  These settings worked on our previous CMS which was completely developed in house. We have recently upgraded our server to PHP 7 and Apache 2.4. We have been using <https://securityheaders.io> to check our results.
  
  Any help trying to get this to work would be really appreciated.
  
  **Tags:** php, htaccess, security
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_1 on 2017-07-17. Score: 2
  
  I'm assuming mod\_headers is installed & active? Otherwhise I can't say why the .htaccess rules are not applied (devOps is not my forte) but you could set them through the twig template.
  
  See [here](https://craftcms.com/docs/templating/header) for the tag to use. Basically it comes down to something like this (untested):
  
  ```
  {% header 'X-Xss-Protection "1; mode=block"' %}
  {% header 'X-Content-Type-Options "nosniff' %}
  {% header 'X-Frame-Options ALLOWALL' %}
  {% header 'Strict-Transport-Security "max-age=31536000"' %}
  {% header 'Referrer-Policy no-referrer' %}
  
  ```
  
  You can make those in a block and just include the block on all the relevant pages.
  
  
  ---
  
  ### Answer by username_2 on 2017-07-17. Score: 1
  
  This is more of a server config issue than a Craft one.
  
  Craft does set a [few of those headers from PHP](https://github.com/pixelandtonic/Craft-Release/blob/master/app/etc/web/WebApp.php#L181-L186), but only for Control Panel requests. It's completely hands-off on the front-end of your site assuming that you'll set whatever headers you want.
  
  As [Michael said](https://craftcms.stackexchange.com/a/21223/57), make sure that mod\_headers is installed and make sure that nothing else in your `.htaccess` or any other `.htaccess` files are interfering. I'd also make sure that something like mod\_security or Suhosin is also not interfering.
  
  
  ---
  
  ### Answer by username_3 on 2020-02-07. Score: -3
  
  For Apache 2.4, please configure in httpd.conf without mod\_headers
  
  .
  .
  .
  
  > **Comments:**
  > **username_4**: Welcome to the Craft CMS Stack Exchange, SFA! Would you mind elaborating on your answer? It seems like you're recommending a solution that would come with significant drawbacks, but it's hard to tell without any justification for why this should be considered.  
  
  ---
  
  