How to Set HTTP Headers Using Apache Server?

HTTP headers are key-value pairs sent in HTTP requests and responses. They carry essential information about the request or response, such as content type, caching directives, and security policies. Setting HTTP Headers in Apache is a common requirement for enhancing the security, performance and functionality of the web application.

Prerequisites

• Apache server Installed.
• Access to Apache configuration files.

Common HTTP Headers

• Content-Type: Indicates the media type of the resource.
• Cache-Control: Directs caching mechanisms on how and when to cache responses.
• Strict-Transport-Security (HSTS): Enforces secure (HTTP over SSL/TLS) connections.
• X-Content-Type-Options: Prevents browsers from MIME-sniffing a response away from the declared content type.
• X-Frame-Options: Controls whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed>, or <object>.
• Content-Security-Policy (CSP): Prevents cross-site scripting (XSS), clickjacking, and other code injection attacks.

There are several methods to set the HTTP headers using apache server which are as follows:

Using`.htaccess` File

This file can be used to set the HTTP headers at a directory level from where the apache servers the pages. commonly form the htdocs directory inside the Apache folder.

Step 1: Open or create a `.htaccess` file in a root directory lets say htdocs as it is a default one. And then add the following directives:

# Enforce HTTPS
<IfModule mod_headers.c>
    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# Prevent MIME type sniffing
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
</IfModule>

# Prevent clickjacking
<IfModule mod_headers.c>
    Header always append X-Frame-Options SAMEORIGIN
</IfModule>

# Content Security Policy
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; object-src 'none'"
</IfModule>

Step 2: Save the .htaccess file.

Step 3: Restart Apache. To do this, open the Command Prompt as an administrator and run:

httpd -k restart

Step 4: If apache is not started run following command:

httpd -k start

Modifying the Apache Configuration File

To apply the http header at server level we need to edit the configuration file(`httpd.conf`).

Example: Setting Cache-Control Header

Step 1: Locate apache configuration file.

Path:

 `C:\Apache24\conf\httpd.conf`.

Step 2: Open httpd.conf in text editor like Notepad.

Step 3: Add the following directives.

<IfModule mod_headers.c>
    # Add a custom header for all responses
    Header add X-Header "geek for geeks"
    
    # Add a custom security header
    Header add Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    
    # Add CORS headers
    Header add Access-Control-Allow-Origin "*"
    Header add Access-Control-Allow-Methods "GET, POST, OPTIONS"
    Header add Access-Control-Allow-Headers "Content-Type, Authorization"
</IfModule>

Step 4: Save the file.

Step 5: Restart Apache using the Command Prompt as an administrator:

httpd -k restart

Step 6: If apache is not started run following command:

httpd -k start

Virtual Host Configuration

to set the headers for a specific website you need to configure them within the virtual host configuration.

Example: Setting X-Frame-Options Header

Step 1: Open the virtual hosting config file for your site.

Path:

 `C:\Apache24\conf\extra\httpd-vhosts.conf`.

Step 2: Add the following directives inside the appropriate <VirtualHost> block:

<VirtualHost *:80>
    ServerName example.com
    DocumentRoot "C:/Apache24/htdocs/example.com"

   <IfModule mod_headers.c>
    # Add a custom header for all responses
    Header add X-Header "geek for geeks"
    
    # Add a custom security header
    Header add Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    
    # Add CORS headers
    Header add Access-Control-Allow-Origin "*"
    Header add Access-Control-Allow-Methods "GET, POST, OPTIONS"
    Header add Access-Control-Allow-Headers "Content-Type, Authorization"
</IfModule>
</VirtualHost>

Step 3: Save the file.

Step 4: Restart Apache using the Command Prompt as an administrator:

httpd -k restart

Step 5: If apache is not started run following command:

httpd -k start

Verify the headers

To verify the header we set in our apache server using above methods we simply navigate to the command prompt and request the url using curl to get the headers as follwos:

curl I - http//localhost:portNum

In my case Iam using the port 809 to check yours visit the httpd file and press ctrl+f and enter por click enter. check the port and change url accordingly.

Conclusion

Configuring HTTP headers in Apache server is must for enhancing your website's security and performance. Whether using the .htaccess file, the main configuration file, or virtual host configurations, ensure you regularly update your headers to make your server more secured.