How to Add Security Headers in Apache

Add security headers in Apache

Apache sets response headers with mod_headers. Enable it (a2enmod headers), then add these to your virtual host or .htaccess:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
Header always set Cross-Origin-Opener-Policy "same-origin"
Header always set X-XSS-Protection "0"

always vs set

Use Header always set rather than Header set so the header is included on error responses (404s, 500s), not just 2xx/3xx. Enable the module and restart:

a2enmod headers
apachectl configtest && systemctl restart apache2

Content Security Policy

Roll out CSP in report-only mode first:

Header always set Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; base-uri 'self'"

then rename it to Content-Security-Policy to enforce. Our CSP guide covers nonces and strict-dynamic.

Verify

Scan with HeaderTest to confirm the headers are live. Per-header guidance: HSTS, nosniff, X-Frame-Options.