I have a self-hosted Wordpress installation on a Linux system and there are a lot of modifications such as blacklisting and path rewrites and so on that is done within the .htaccess file that all work fine.

However, I have this block of rules:

<IfModule mod_headers.c>
   Header set X-XSS-Protection "1; mode=block"
   Header always append X-Frame-Options SAMEORIGIN
   Header set X-Content-Type-Options nosniff

but it does not take effect and does not get applied. I have verified the syntax and to the best of ability and consistent with the documentation, it is correct. So anyone can provide me an explanation as to why it is not taking effect and what I might need to do to get it to work.

I would appreciate any assistance in better understanding what is going on and where the disconnect is. I would post the ENTIRE .htaccess but the fact is that its fairly long and I didn't want to clutter the post. Also, not that it should matter (at least I don't think so) but this block is at the very end of the file.

Site Details:

  • WordPress version: 4.2.4
  • Running on: Apache
  • Powered by: PHP/5.5.26

1 Answer 1


The RewriteEngine On line (as you have indicated) isn't necessary, and pertains to a different module, mod_rewrite. You should remove it from the mod_headers block.

It's possible that you don't have the Headers Apache module installed or activated on your host. If it is possible to run the test with some breakage, you could try removing the If block and running the commands in the parent context. If it fails, that's a good indication that it wasn't working because Headers wasn't installed.

If you are on a Debian system (Ubuntu, etc) you can enable the Headers Apache module like so via SSH:

sudo a2enmod headers
sudo service apache2 restart
  • Thank you for the answer. I realized it wasn't required, but it was recommended so I tried it but in the current condition, it is not present. I even removed the IFModule block to see if it would at least generate an error so I could see what's wrong but no error but still no headers either which is not only frustrating but also extremely puzzling. I would do shell configuration on it if I could but unfortunately its managed hosting and while the host states that mod_headers and full .htaccess is in place, this still plagues my understanding of what's going on. Aug 11, 2015 at 22:58
  • You could try a Header directive straight out of the Apache documentation and see if you can set headers at all: Header append Cache-Control s-maxage=600 "expr=%{REQUEST_STATUS} == 200" Via: httpd.apache.org/docs/current/mod/mod_headers.html Apache version: 2.4 (syntax might be different if you are still on 2.2) Aug 12, 2015 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.