Tech Wave Cloud Guide

Security Headers Checker for Apache: The Complete Guide

Learn how to use a security headers checker for Apache, understand key HTTP headers, and fix missing headers with copy-paste config snippets.

If you run a website on Apache, you've probably heard about security headers. But what are they, and why should you care? A security headers checker for Apache is a simple online tool that scans your site's HTTP response headers and tells you which security protections are missing or misconfigured. In this guide, we'll explain what security headers are, why they matter, and how to check and fix them on your Apache server. By the end, you'll know exactly which headers to add and how to add them using .htaccess or httpd.conf.

What Are HTTP Security Headers? (Plain-English Explanation)

When a browser requests a page from your website, your web server sends back the page content along with a set of instructions called HTTP response headers. Some of these headers control how the browser should behave for security reasons. Think of them as a list of rules you give to your visitors' browsers: "Don't load scripts from unknown sources," "Never display this site inside a frame," or "Always use HTTPS for this domain."

These rules are called security headers. They are not visible on the page itself, but they silently protect your visitors from common attacks like cross-site scripting (XSS), clickjacking, and MIME sniffing. Because they are sent by the server, they work in all modern browsers without requiring any action from your users.

Why Security Headers Matter for Apache Websites

Apache is one of the most widely used web servers in the world. It's powerful and flexible, but it doesn't enable many security headers by default. That means if you don't explicitly configure them, your site is missing an important layer of defense.

Security headers help you:

Prevent XSS attacks by restricting where scripts can be loaded from.
Stop clickjacking by preventing your site from being embedded in iframes on other domains.
Enforce HTTPS so that browsers always connect securely, even if a user types http://.
Block MIME sniffing that could turn an innocent file upload into an executable script.
Control referrer information to protect user privacy.

Beyond security, having these headers can also improve your site's reputation. Some security scanners and compliance standards (like PCI DSS) require them. And while search engines don't directly rank you higher for having them, a safer site means fewer incidents that could harm your SEO.

The 7 Most Important Security Headers to Check

Not all security headers are equally important. Here are the seven you should prioritize on any Apache site:

Strict-Transport-Security (HSTS) – Forces browsers to use HTTPS for all future requests to your domain. It prevents SSL stripping attacks and mixed content issues.
Content-Security-Policy (CSP) – The most powerful header for mitigating XSS. It lets you define approved sources for scripts, styles, images, and more.
X-Content-Type-Options – Set to nosniff to stop browsers from guessing a file's MIME type, which can lead to drive-by downloads.
X-Frame-Options – Protects against clickjacking by controlling whether your site can be framed. Use DENY or SAMEORIGIN.
Referrer-Policy – Controls how much referrer information is sent with requests. strict-origin-when-cross-origin is a good default.
Permissions-Policy – Restricts access to browser features like camera, microphone, and geolocation. Formerly known as Feature-Policy.
Cross-Origin-Opener-Policy (COOP) – Isolates your browsing context to prevent cross-origin attacks like Spectre. Often paired with Cross-Origin-Resource-Policy (CORP).

There are other headers like Cross-Origin-Embedder-Policy and X-XSS-Protection (now deprecated), but the seven above give you the best return on effort.

How to Check Security Headers on an Apache Site (Step-by-Step)

Checking your headers is quick and doesn't require any technical expertise. Here are three methods, from easiest to most advanced:

Method 1: Use an Online Security Headers Checker

The simplest way is to use a free online tool. Our Security Headers Checker scans your URL and gives you a detailed report. Just enter your domain, click "Check," and you'll see which headers are present, missing, or misconfigured.

Method 2: Browser Developer Tools

Open your site in Chrome or Firefox, press F12 to open Developer Tools, go to the Network tab, and reload the page. Click on the main document request and look at the Response Headers section. You'll see all headers sent by Apache.

Method 3: Command Line with cURL

If you're comfortable with the terminal, run:

curl -I https://yourdomain.com

This displays the HTTP response headers. Look for the security headers listed above.

Using the Security Headers Checker Tool

Our security headers checker for Apache is designed to be straightforward. Here's how to get the most out of it:

Enter your full URL (including https://).
Click the check button.
Review the results. The tool will show a grade or score and list each header with its status.
Pay attention to any warnings or recommendations.

The tool also provides explanations for each header, so you can learn as you go. If you need to inspect all response headers, not just security ones, try our HTTP Headers Checker for a complete view.

How to Read Your Security Headers Report

After running a check, you'll see a list of headers with statuses like "Present," "Missing," or "Misconfigured." Here's what to look for:

Missing headers: These are opportunities to improve security. Prioritize HSTS, CSP, and X-Content-Type-Options.
Misconfigured headers: For example, an HSTS header with a very short max-age, or a CSP that allows unsafe-inline. These still provide some protection but can be strengthened.
Warnings: Some headers may conflict or be deprecated. The tool will flag these.

Aim for a balanced approach: don't just add headers for the sake of a perfect score. Each header should be correctly configured for your site's needs.

Common Security Headers Missing on Apache (and Why)

Apache doesn't add security headers by default. Unless you or your hosting provider explicitly configures them, they won't be sent. Here are the most commonly missing headers and the reasons:

Strict-Transport-Security: Often overlooked because site owners assume HTTPS alone is enough. It's not—HSTS ensures browsers never fall back to HTTP.
Content-Security-Policy: Can be complex to set up, especially for sites with many third-party scripts. Many admins delay it to avoid breaking functionality.
X-Content-Type-Options: Simple to add but frequently forgotten.
X-Frame-Options: Sometimes omitted because the site doesn't use iframes, but it's still a good defense-in-depth measure.
Referrer-Policy: Often ignored because its impact on security is less obvious.
Permissions-Policy: Relatively new and not widely known.
Cross-Origin-Opener-Policy: Advanced header that many admins haven't heard of.

Another common issue: headers added in .htaccess but not in httpd.conf, or vice versa, leading to inconsistent behavior across different directories or virtual hosts.

How to Add Security Headers in Apache (.htaccess and httpd.conf)

Apache provides the mod_headers module to manipulate HTTP headers. Most hosting providers enable it by default. You can add headers either in a per-directory .htaccess file or in the main server configuration (httpd.conf or a virtual host file).

Using .htaccess

The .htaccess file is placed in your website's root directory (or any subdirectory). It's convenient because you don't need to restart the server, and it works on shared hosting. However, it only applies to the directory it's in and its subdirectories.

Using httpd.conf

Editing httpd.conf (or a file in conf.d/ or sites-available/) gives you server-wide control. Changes require a server restart or reload. This is the preferred method if you have root access, as it's more efficient and less prone to being overridden.

Before adding headers, ensure mod_headers is enabled. On Debian/Ubuntu, run a2enmod headers and restart Apache. On CentOS/RHEL, it's usually enabled by default.

Copy-Paste Apache Snippets for Key Headers

Below are ready-to-use snippets. You can paste them into your .htaccess file or inside a <Directory>, <Location>, or <VirtualHost> block in your Apache configuration.

1. Strict-Transport-Security (HSTS)

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>

Note: Only add includeSubDomains and preload if you are sure all subdomains support HTTPS. Start with a lower max-age (e.g., 300) for testing.

2. Content-Security-Policy (CSP)

<IfModule mod_headers.c>
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' https://trusted.cdn.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'"
</IfModule>

Tip: Start with a report-only policy using Content-Security-Policy-Report-Only to see what would break before enforcing.

3. X-Content-Type-Options

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
</IfModule>

4. X-Frame-Options

<IfModule mod_headers.c>
  Header always set X-Frame-Options "SAMEORIGIN"
</IfModule>

Use DENY if you never need to frame your own site.

5. Referrer-Policy

<IfModule mod_headers.c>
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

6. Permissions-Policy

<IfModule mod_headers.c>
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

7. Cross-Origin-Opener-Policy (COOP)

<IfModule mod_headers.c>
  Header always set Cross-Origin-Opener-Policy "same-origin"
</IfModule>

You can combine all these headers into a single <IfModule> block to keep your configuration tidy.

Testing Your Changes and Avoiding Common Mistakes

After adding headers, always test your site thoroughly. Here are common pitfalls and how to avoid them:

Forgetting to clear your browser cache: Headers may be cached. Use a private window or hard refresh.
Syntax errors in .htaccess: A single typo can cause a 500 Internal Server Error. Always back up your file before editing.
Overly restrictive CSP: This can break scripts, styles, or images. Test with report-only mode first.
HSTS on a site without full HTTPS: If any part of your site is still HTTP, HSTS will make it inaccessible. Ensure all resources are HTTPS.
Duplicate headers: If you set a header in both .htaccess and httpd.conf, you might get duplicates. Use Header always set to override, or Header unset to remove.
Not checking subdomains: If you use includeSubDomains in HSTS, all subdomains must support HTTPS.

After making changes, re-run the Security Headers Checker to confirm the headers are now present and correctly configured. Also use our Redirect Checker to ensure HTTP to HTTPS redirects are working, which is crucial for HSTS.

Security Headers vs. Other Website Security Measures

Security headers are just one layer of a robust security strategy. They don't replace:

HTTPS/TLS: Headers like HSTS depend on HTTPS, but they don't encrypt data themselves. You still need a valid SSL/TLS certificate.
Input validation and output encoding: These prevent injection attacks at the application level.
Web Application Firewall (WAF): A WAF can block malicious traffic, while headers harden the browser's behavior.
Regular updates and patching: Keeping Apache, CMS, and plugins up to date is essential.

Think of security headers as a cheap, effective way to add defense-in-depth. They are not a silver bullet, but they significantly raise the bar for attackers.

Frequently Asked Questions

What are HTTP security headers and why do they matter?

They are instructions sent by your web server to browsers to enforce security policies. They matter because they protect against common attacks like XSS, clickjacking, and protocol downgrade attacks.

How do I check security headers on an Apache website?

Use an online tool like our Security Headers Checker, browser developer tools, or the curl -I command.

Which security headers should every Apache site have?

At minimum: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy. Permissions-Policy and COOP are also recommended.

How do I add security headers in Apache using .htaccess?

Use the Header always set directive from mod_headers inside an <IfModule mod_headers.c> block. See the snippets above.

What is the difference between .htaccess and httpd.conf for security headers?

.htaccess is per-directory and doesn't require a restart; httpd.conf is server-wide and requires a reload but is more efficient.

Why are my security headers missing even though I added them?

Possible reasons: mod_headers is not enabled, syntax errors, headers set in the wrong context, or a caching layer stripping them. Check your server error logs.

Can security headers break my website?

Yes, if misconfigured. A strict CSP can block legitimate scripts, and HSTS can lock you out if HTTPS isn't fully set up. Test carefully.

How often should I check my website's security headers?

Check after any server or site change, and at least quarterly as part of a security audit.

Do security headers replace the need for HTTPS?

No. HTTPS encrypts data in transit; security headers add browser-level protections. They complement each other.

What is a good security headers score?

Aim for an A grade or equivalent, but prioritize correctly configured headers over a perfect score. Some headers may not be suitable for all sites.

Next Steps: Keep Monitoring Your Headers

Security is not a one-time task. After adding headers, make it a habit to check them regularly. Use our Security Headers Checker to quickly scan your site. For a deeper dive into all HTTP headers, try the HTTP Headers Checker. If you're also concerned about SEO, the Meta Tag Analyzer can help you audit your HTML head. And to ensure your domain and redirects are properly configured, use our DNS Lookup and Redirect Checker tools. Finally, keep an eye on page performance with the Page Size Checker.

Start by checking your headers today—it takes less than a minute and could save you from a serious security incident tomorrow.