Apache Security Headers Configuration on Ubuntu

This tutorial covers common HTTP security headers that can be configured in Apache using mod_headers. The examples include HSTS, Content Security Policy, Referrer Policy, Permissions Policy, Cross-Origin policies and other security-related headers.

1. Enable Apache Headers Module

sudo a2enmod headers
sudo systemctl restart apache2

Verify the module:

apache2ctl -M | grep headers

2. Strict-Transport-Security (HSTS)

Add this to the HTTPS virtual host configuration:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

For example:

sudo nano /etc/apache2/sites-available/000-default.conf

Place the header inside the SSL-enabled virtual host.

3. Content-Security-Policy (CSP)

You can keep the CSP configuration in a separate Apache configuration file:

sudo nano /etc/apache2/conf-available/csp.conf

Example from this configuration:

# Example CSP
Header always set Content-Security-Policy "default-src 'self';"

# Example resource policies
Header always set Content-Security-Policy "style-src-elem: 'self' use.fontawesome.com fonts.googleapis.com cdn.jsdelivr.net;"
Header always set Content-Security-Policy "font-src: fonts.googleapis.com;"

Enable it with:

sudo a2enconf csp
sudo systemctl restart apache2

Important: The supplied configuration contains multiple CSP examples. Do not blindly enable several different Content-Security-Policy headers for the same site. Build one CSP that matches the site's actual scripts, styles, fonts, images, frames and external services.

4. X-Permitted-Cross-Domain-Policies

Header always set X-Permitted-Cross-Domain-Policies "none"

This can be placed in your Apache configuration where mod_headers is active.

5. Referrer-Policy

Example:

Header always set Referrer-Policy "no-referrer"

Place it in the HTTPS virtual host configuration.

6. Clear-Site-Data

Header always set Clear-Site-Data "cache, cookies, storage"

This header can clear client-side data. Use it carefully and normally only on responses where clearing site data is actually intended. Do not enable it globally without understanding its effect.

7. Cross-Origin-Embedder-Policy

Header always set Cross-Origin-Embedder-Policy "require-corp"

8. Cross-Origin-Opener-Policy

Header always set Cross-Origin-Opener-Policy "same-origin"

9. Cross-Origin-Resource-Policy

Header always set Cross-Origin-Resource-Policy "same-origin"

Cross-origin policies can affect external scripts, fonts, images, iframes and other resources. Test the complete website after enabling them.

10. Permissions-Policy

Example from the supplied configuration:

Header always set Permissions-Policy "geolocation=(self '*.tsdemo.co.in'); microphone=()"

Another example in the supplied configuration is:

Header always set Permissions-Policy "fullscreen 'none'"

Use a single policy appropriate to your application rather than combining conflicting examples.

11. Additional Security Headers

Common headers included in the supplied Apache configuration are:

Header set X-Frame-Options "sameorigin"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"
Header set X-Permitted-Cross-Domain-Policies "none"
Header unset X-Forwarded-Host

12. CORS Example

The supplied configuration also contains:

Header add Access-Control-Allow-Origin "*"

Use this only when your application intentionally needs cross-origin access. A wildcard CORS policy allows requests from any origin, so it should not be enabled automatically for every site.

13. Apache Server Information

The supplied configuration also contains:

ServerSignature Off
ServerTokens Prod
DirectoryIndex index.html index.php

14. Example Header Block

The supplied notes combine several security headers into a single mod_headers section. A starting point is:

<IfModule mod_headers.c>

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header always set X-Permitted-Cross-Domain-Policies "none"
Header always set Referrer-Policy "no-referrer"
Header always set Cross-Origin-Opener-Policy "same-origin"
Header always set Cross-Origin-Resource-Policy "same-origin"
Header always set Cross-Origin-Embedder-Policy "require-corp"
Header always set X-Frame-Options "sameorigin"
Header always set X-Content-Type-Options "nosniff"

</IfModule>

Add CSP and Permissions-Policy only after choosing values that match your application's resources and requirements.

15. Test the Headers

After restarting Apache, check the live HTTPS response:

curl -I https://YOUR-DOMAIN.COM

For example:

curl -I https://example.com

Look for headers such as:

Strict-Transport-Security:
Content-Security-Policy:
X-Frame-Options:
X-Content-Type-Options:
Referrer-Policy:
Permissions-Policy:
Cross-Origin-Embedder-Policy:
Cross-Origin-Opener-Policy:
Cross-Origin-Resource-Policy:

16. Validate Apache Configuration

sudo apache2ctl configtest

You should get:

Syntax OK

Then reload Apache:

sudo systemctl reload apache2

Important

The supplied configuration contains multiple alternative and repeated header blocks. Do not copy all of them into Apache at the same time. In particular, keep a single effective CSP and a single Permissions-Policy for the site, and test external resources after enabling COEP, COOP, CORP or a restrictive CSP.

Suggested category: Linux / Apache / Security