Apache · Configuration and operations
How do you set and modify HTTP headers in Apache?
Short answer
mod_headers provides Header and RequestHeader directives to set, append, merge or unset headers. Use the always condition for error responses and avoid duplicating headers that a reverse proxy already sets.
Response headers control caching, security policy, CORS and content handling. Request headers control what Apache or a backend sees. mod_headers can modify both, but the order of directives and the always condition determine whether a header survives an error response or an internal redirect.
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "geolocation=(), microphone=()"
Header always set Content-Security-Policy "default-src 'self'"
Header unset X-Powered-By
Header unset Server
RequestHeader set X-Forwarded-Proto "https"Header actions
- set replaces an existing header or adds it if absent
- append adds another value to an existing header
- merge combines values but does not duplicate identical ones
- unset removes a header entirely
- edit performs a regex replacement on an existing value
- always applies to error responses and redirects as well as normal responses
A Content-Security-Policy set here applies to every response in scope, so make sure it matches the application's actual asset origins. Start with Report-Only if you need to discover violations, then enforce after the reports are clean.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1What does the always condition change?
- 2When should you use append instead of set?
- 3How do you remove a header added by PHP?
- 4Where should security headers be owned in a proxy setup?
Say it in the interview
mod_headers lets me set, append or remove response and request headers. I use always for security headers so they also apply to errors and redirects. I avoid conflicts by deciding whether Apache or the app owns a header, and I check the final response with curl. For CSP I start in report-only mode before enforcing.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Apache mock interview and get scored feedback on depth, clarity and confidence.