We have an issue on our server when our Security Headers are not working. We added the following to our htaccess file after installing Craft CMS: -

<IfModule mod_headers.c>
    Header always set X-Xss-Protection "1; mode=block"
    Header always set X-Content-Type-Options "nosniff"
    Header always append X-Frame-Options ALLOWALL
    Header always set Strict-Transport-Security "max-age=31536000"
    Header always set Referrer-Policy no-referrer

These settings worked on our previous CMS which was completely developed in house. We have recently upgraded our server to PHP 7 and Apache 2.4. We have been using https://securityheaders.io to check our results.

Any help trying to get this to work would be really appreciated.

3 Answers 3


I'm assuming mod_headers is installed & active? Otherwhise I can't say why the .htaccess rules are not applied (devOps is not my forte) but you could set them through the twig template.

See here for the tag to use. Basically it comes down to something like this (untested):

{% header 'X-Xss-Protection "1; mode=block"' %}
{% header 'X-Content-Type-Options "nosniff' %}
{% header 'X-Frame-Options ALLOWALL' %}
{% header 'Strict-Transport-Security "max-age=31536000"' %}
{% header 'Referrer-Policy no-referrer' %}

You can make those in a block and just include the block on all the relevant pages.


This is more of a server config issue than a Craft one.

Craft does set a few of those headers from PHP, but only for Control Panel requests. It's completely hands-off on the front-end of your site assuming that you'll set whatever headers you want.

As Michael said, make sure that mod_headers is installed and make sure that nothing else in your .htaccess or any other .htaccess files are interfering. I'd also make sure that something like mod_security or Suhosin is also not interfering.


For Apache 2.4, please configure in httpd.conf without mod_headers

. . .

  • 3
    Welcome to the Craft CMS Stack Exchange, SFA! Would you mind elaborating on your answer? It seems like you're recommending a solution that would come with significant drawbacks, but it's hard to tell without any justification for why this should be considered.
    – Matt Stein
    Commented Feb 9, 2020 at 2:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.