Title: Missing Headers
Last modified: June 5, 2020
---
# Missing Headers
* Resolved [khemlanimart](https://wordpress.org/support/users/khemlanimart/)
* (@khemlanimart)
* [5 years, 11 months ago](https://wordpress.org/support/topic/missing-headers-2/)
* Hi. I’ve added about 6 different security headers to my website, but in the plugin
inspection and external 3rd part inspection, all are missing. I’m using apache
and have the default mode set for the plugin. When I checked .htaccess, the plugin
headers are the under the ifmodule.
* The page I need help with: _[[log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fmissing-headers-2%2F%3Foutput_format%3Dmd&locale=en_US)
to see the link]_
Viewing 11 replies - 1 through 11 (of 11 total)
* Plugin Author [Dimitar Ivanov](https://wordpress.org/support/users/zinoui/)
* (@zinoui)
* [5 years, 11 months ago](https://wordpress.org/support/topic/missing-headers-2/#post-12946461)
* Hi [@khemlanimart](https://wordpress.org/support/users/khemlanimart/)
* Can you post here those headers?
Also, are you sure the module you mention above
is loaded on your server?
* Thread Starter [khemlanimart](https://wordpress.org/support/users/khemlanimart/)
* (@khemlanimart)
* [5 years, 11 months ago](https://wordpress.org/support/topic/missing-headers-2/#post-12948394)
* Hi. The headers I have added are:
X-Frame-Options SAMEORIGIN X-XSS-Protection
1; mode=block X-Content-Type-Options nosniff Referrer-Policy origin Content-Security-
Policy default-src ‘self’; script-src ‘self’; style-src ‘self’; img-src https:;
child-src ‘none’ Feature-Policy camera ‘self’; domain ‘self’; payment ‘self’
* When I go into my .htaccess I see:
# END WordPress # BEGIN HttpHeaders # The
directives (lines) between `BEGIN HttpHeaders` and `END HttpHeaders` are # dynamically
generated, and should only be modified via WordPress filters. # Any changes to
the directives between these markers will be overwritten. Header always set X-Content-Type-Options “nosniff” Header set X-Frame-Options “SAMEORIGIN” Header set X-XSS-Protection “1; mode
=block” Header set Content-Security-Policy “default-src ‘self’; script-src ‘self’;
style-src ‘self’; img-src https:; child-src ‘none'” Header set Referrer-Policy“
origin” Header set Feature-Policy “camera ‘self’; domain ‘self’; payment ‘self'”
* I restarted the server as well
* Plugin Author [Dimitar Ivanov](https://wordpress.org/support/users/zinoui/)
* (@zinoui)
* [5 years, 11 months ago](https://wordpress.org/support/topic/missing-headers-2/#post-12961862)
* Now, you need to ensure you have the **mod_headers** module loaded and worked.
To do so run the following command:
* `apache2ctl -M`
* If you can’t access command-line, the easiest way is to put a comment sign in
front of start and end IfModule statement in your .htaccess file. If module is
not loaded you will get a 500 Internal Server Error. If so, first remove the
comments and error will disappear, then you need to activate/load the mod_headers
module.
* ```
#
...
#
```
* If no error occurs, the module should be loaded.
* The other thing that could possibly stops .htaccess rules is to have the following
directive in your server httpd.conf file:
`AllowOverride None`
* If that’s the case, nothing from .htaccess will works. Need to be changed to:
`
AllowOverride All`
- This reply was modified 5 years, 11 months ago by [Dimitar Ivanov](https://wordpress.org/support/users/zinoui/).
Reason: clarification
* Thread Starter [khemlanimart](https://wordpress.org/support/users/khemlanimart/)
* (@khemlanimart)
* [5 years, 11 months ago](https://wordpress.org/support/topic/missing-headers-2/#post-12968897)
* [@zinoui](https://wordpress.org/support/users/zinoui/) Thanks so much for the
help, but it’s still not working. I ran apache2ctl -M and got back
* ```
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
Loaded Modules:
core_module (static)
so_module (static)
watchdog_module (static)
http_module (static)
log_config_module (static)
logio_module (static)
version_module (static)
unixd_module (static)
access_compat_module (shared)
alias_module (shared)
auth_basic_module (shared)
authn_core_module (shared)
authn_file_module (shared)
authz_core_module (shared)
authz_host_module (shared)
authz_user_module (shared)
autoindex_module (shared)
deflate_module (shared)
dir_module (shared)
env_module (shared)
filter_module (shared)
mime_module (shared)
mpm_prefork_module (shared)
negotiation_module (shared)
php7_module (shared)
reqtimeout_module (shared)
rewrite_module (shared)
setenvif_module (shared)
socache_shmcb_module (shared)
ssl_module (shared)
status_module (shared)
```
* I couldn’t find a httpd.conf but I found apache2.conf and changed the following:
* ```
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
```
* AllowOverride was originally None. I restarted the apache2 service after doing
this and ran sudo a2enmod rewrite both of which were successful.
* I also tried commenting out (not “.so” which I dont
seem to have) and that caused a 500 Internal Server Error for the website :/.
Is there anything else you could think of that could locate the problem?
* Thread Starter [khemlanimart](https://wordpress.org/support/users/khemlanimart/)
* (@khemlanimart)
* [5 years, 11 months ago](https://wordpress.org/support/topic/missing-headers-2/#post-12968917)
* I also tried switching to PHP, which worked but caused errors with some of my
plugins
* Thread Starter [khemlanimart](https://wordpress.org/support/users/khemlanimart/)
* (@khemlanimart)
* [5 years, 11 months ago](https://wordpress.org/support/topic/missing-headers-2/#post-12968929)
* Ok. I was able to get it by switching over to PHP (deprecated).
* Plugin Author [Dimitar Ivanov](https://wordpress.org/support/users/zinoui/)
* (@zinoui)
* [5 years, 11 months ago](https://wordpress.org/support/topic/missing-headers-2/#post-12969094)
* I can’t see the **headers_module** in the list returned from `apache2ctl -M`
command. To make it work you need to enable that module.
* Of course, PHP mode is also an option.
* Regards,
* Thread Starter [khemlanimart](https://wordpress.org/support/users/khemlanimart/)
* (@khemlanimart)
* [5 years, 11 months ago](https://wordpress.org/support/topic/missing-headers-2/#post-12969119)
* [@zinoui](https://wordpress.org/support/users/zinoui/) Agreed. How do I add the
module though, do I do it manually?
* Plugin Author [Dimitar Ivanov](https://wordpress.org/support/users/zinoui/)
* (@zinoui)
* [5 years, 11 months ago](https://wordpress.org/support/topic/missing-headers-2/#post-12971344)
* In the Apache’s **httpd.conf** search for:
* `#LoadModule headers_module /path/to/modules/mod_headers.so`
* then remove the comment, and restart Apache. This should be enough.
* Thread Starter [khemlanimart](https://wordpress.org/support/users/khemlanimart/)
* (@khemlanimart)
* [5 years, 11 months ago](https://wordpress.org/support/topic/missing-headers-2/#post-12971518)
* Hi [@zinoui](https://wordpress.org/support/users/zinoui/). I’ll go ahead and
mark this closed. I can’t find httpd.conf only apache2.conf and that line doesn’t
seem to be there. Moreover, the file in .htaccess says mod_headers.c not mod_headers.
so and I’m not an expert in these things so I’m not sure if theyre the same.
I will just use php for now I guess. Thanks again.
* Thread Starter [khemlanimart](https://wordpress.org/support/users/khemlanimart/)
* (@khemlanimart)
* [5 years, 11 months ago](https://wordpress.org/support/topic/missing-headers-2/#post-12971523)
* Resolved
Viewing 11 replies - 1 through 11 (of 11 total)
The topic ‘Missing Headers’ is closed to new replies.
* 
* [HTTP Headers](https://wordpress.org/plugins/http-headers/)
* [Frequently Asked Questions](https://wordpress.org/plugins/http-headers/#faq)
* [Support Threads](https://wordpress.org/support/plugin/http-headers/)
* [Active Topics](https://wordpress.org/support/plugin/http-headers/active/)
* [Unresolved Topics](https://wordpress.org/support/plugin/http-headers/unresolved/)
* [Reviews](https://wordpress.org/support/plugin/http-headers/reviews/)
## Tags
* [missing headers](https://wordpress.org/support/topic-tag/missing-headers/)
* [not working](https://wordpress.org/support/topic-tag/not-working/)
* 11 replies
* 2 participants
* Last reply from: [khemlanimart](https://wordpress.org/support/users/khemlanimart/)
* Last activity: [5 years, 11 months ago](https://wordpress.org/support/topic/missing-headers-2/#post-12971523)
* Status: resolved