I have a self-hosted Wordpress installation on a Linux system and there are a lot of modifications such as blacklisting and path rewrites and so on that is done within the .htaccess file that all work fine.

However, I have this block of rules:

<IfModule mod_headers.c>
   Header set X-XSS-Protection "1; mode=block"
   Header always append X-Frame-Options SAMEORIGIN
   Header set X-Content-Type-Options nosniff

but it does not take effect and does not get applied. I have verified the syntax and to the best of ability and consistent with the documentation, it is correct. So anyone can provide me an explanation as to why it is not taking effect and what I might need to do to get it to work.

I would appreciate any assistance in better understanding what is going on and where the disconnect is. I would post the ENTIRE .htaccess but the fact is that its fairly long and I didn't want to clutter the post. Also, not that it should matter (at least I don't think so) but this block is at the very end of the file.

Site Details:

  • WordPress version: 4.2.4
  • Running on: Apache
  • Powered by: PHP/5.5.26

The RewriteEngine On line (as you have indicated) isn't necessary, and pertains to a different module, mod_rewrite. You should remove it from the mod_headers block.

It's possible that you don't have the Headers Apache module installed or activated on your host. If it is possible to run the test with some breakage, you could try removing the If block and running the commands in the parent context. If it fails, that's a good indication that it wasn't working because Headers wasn't installed.

If you are on a Debian system (Ubuntu, etc) you can enable the Headers Apache module like so via SSH:

sudo a2enmod headers
sudo service apache2 restart
  • Thank you for the answer. I realized it wasn't required, but it was recommended so I tried it but in the current condition, it is not present. I even removed the IFModule block to see if it would at least generate an error so I could see what's wrong but no error but still no headers either which is not only frustrating but also extremely puzzling. I would do shell configuration on it if I could but unfortunately its managed hosting and while the host states that mod_headers and full .htaccess is in place, this still plagues my understanding of what's going on. – GµårÐïåñ Aug 11 '15 at 22:58
  • You could try a Header directive straight out of the Apache documentation and see if you can set headers at all: Header append Cache-Control s-maxage=600 "expr=%{REQUEST_STATUS} == 200" Via: httpd.apache.org/docs/current/mod/mod_headers.html Apache version: 2.4 (syntax might be different if you are still on 2.2) – Kevin Fodness Aug 12 '15 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.