Headers & CORS in Apache
From the Apache cheat sheet · Security & Access Control · verified Jul 2026
Headers & CORS
Set security headers and configure CORS with mod_headers
apacheconf
# Enable mod_headers
# sudo a2enmod headers
# Security headers
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "SAMEORIGIN"
Header set X-XSS-Protection "1; mode=block"
Header set Strict-Transport-Security "max-age=31536000"💡 ServerTokens Prod hides your Apache version from response headers — basic security hygiene
⚡ HSTS with preload tells browsers to ALWAYS use HTTPS — submit to hstspreload.org
📌 Never use Access-Control-Allow-Origin "*" with credentials — use specific origins instead
🟢 Use SetEnvIf to dynamically set CORS origin from a whitelist of allowed domains
headerscorssecurity