Configure Apache security headers and Content Security Policy for enhanced web application protection

Intermediate 25 min Jun 02, 2026 433 views
Ubuntu 24.04 Debian 12 AlmaLinux 9 Rocky Linux 9

Configure essential security headers including HSTS, CSRF protection, and Content Security Policy (CSP) in Apache to protect your web applications from common attacks like XSS, clickjacking, and data injection vulnerabilities.

Prerequisites

  • Apache web server installed and running
  • Root or sudo access
  • Basic understanding of web security concepts
  • SSL certificates configured (recommended)

What this solves

Web applications face constant threats from cross-site scripting (XSS), clickjacking, and data injection attacks. HTTP security headers provide your first line of defense by instructing browsers how to handle your content safely. This tutorial configures Apache with essential security headers including Content Security Policy (CSP), HSTS, and anti-clickjacking protections to significantly reduce your attack surface.

Step-by-step configuration

Enable required Apache modules

Apache needs the headers module to add security headers and the security module for advanced CSP features. Enable both modules to get started.

sudo a2enmod headers
sudo a2enmod security2
sudo httpd -M | grep -E "(headers|security)"
# If not loaded, check /etc/httpd/conf.modules.d/00-base.conf
sudo systemctl reload httpd

Install ModSecurity for CSP enforcement

ModSecurity provides advanced Content Security Policy features and violation reporting. Install it to enable comprehensive CSP protection.

sudo apt update
sudo apt install -y libapache2-mod-security2
sudo a2enmod security2
sudo dnf install -y epel-release
sudo dnf install -y mod_security

Create security headers configuration

Create a dedicated configuration file for security headers. This keeps your security settings organized and makes them easy to manage across virtual hosts.

# Security Headers Configuration
# Enable security headers for all responses

Configure ModSecurity for CSP reporting

Set up ModSecurity to handle CSP violation reports. This helps you identify and fix CSP issues in your applications.

# Enable ModSecurity engine
SecRuleEngine On

# Configure audit logging
SecAuditEngine RelevantOnly
SecAuditLog /var/log/apache2/modsec_audit.log

# CSP violation logging
SecRule REQUEST_URI "@streq /csp-report" \
    "id:1001,phase:1,pass,nolog,ctl:ruleEngine=Off"

# Log CSP violations
SecRule REQUEST_METHOD "@streq POST" \
    "chain,id:1002,phase:2,msg:'CSP Violation Report',logdata:'%{REQUEST_BODY}'"
SecRule REQUEST_URI "@streq /csp-report" \
    "t:none"
# Enable ModSecurity engine
SecRuleEngine On

# Configure audit logging
SecAuditEngine RelevantOnly
SecAuditLog /var/log/httpd/modsec_audit.log

# CSP violation logging
SecRule REQUEST_URI "@streq /csp-report" \
    "id:1001,phase:1,pass,nolog,ctl:ruleEngine=Off"

# Log CSP violations
SecRule REQUEST_METHOD "@streq POST" \
    "chain,id:1002,phase:2,msg:'CSP Violation Report',logdata:'%{REQUEST_BODY}'"
SecRule REQUEST_URI "@streq /csp-report" \
    "t:none"

Create CSP violation report handler

Create a simple endpoint to receive and log CSP violation reports. This helps you monitor policy violations and adjust your CSP as needed.

 'Method not allowed']));
}

// Get the raw POST data
$input = file_get_contents('php://input');
$data = json_decode($input, true);

if ($data && isset($data['csp-report'])) {
    $report = $data['csp-report'];
    
    // Log the violation
    $logEntry = [
        'timestamp' => date('c'),
        'blocked-uri' => $report['blocked-uri'] ?? 'unknown',
        'document-uri' => $report['document-uri'] ?? 'unknown',
        'violated-directive' => $report['violated-directive'] ?? 'unknown',
        'source-file' => $report['source-file'] ?? 'unknown',
        'line-number' => $report['line-number'] ?? 'unknown'
    ];
    
    // Write to log file
    file_put_contents(
        '/var/log/apache2/csp-violations.log',
        json_encode($logEntry) . "\n",
        FILE_APPEND | LOCK_EX
    );
    
    http_response_code(204); // No content
} else {
    http_response_code(400);
    exit(json_encode(['error' => 'Invalid report format']));
}
?>

Enable security headers configuration

Enable the security headers configuration and restart Apache to apply the changes.

sudo a2enconf security-headers
sudo apache2ctl configtest
sudo systemctl restart apache2
sudo httpd -t
sudo systemctl restart httpd

Configure application-specific CSP

Customize the Content Security Policy for your specific application. This example shows a more restrictive policy for a typical web application.

Set up log rotation for security logs

Configure log rotation for CSP violation logs and ModSecurity audit logs to prevent disk space issues.

/var/log/apache2/csp-violations.log {
    daily
    missingok
    rotate 30
    compress
    delaycompress
    notifempty
    create 640 www-data adm
    postrotate
        systemctl reload apache2 > /dev/null 2>&1 || true
    endscript
}

/var/log/apache2/modsec_audit.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 640 www-data adm
    postrotate
        systemctl reload apache2 > /dev/null 2>&1 || true
    endscript
}

Verify your setup

Test your security headers configuration to ensure everything is working correctly.

# Check Apache configuration
sudo apache2ctl configtest

# Test security headers with curl
curl -I https://example.com

# Specifically check for security headers
curl -s -D- https://example.com | grep -E "(Strict-Transport|Content-Security|X-Frame|X-Content-Type)"

# Test CSP violation reporting
curl -X POST https://example.com/csp-report \
  -H "Content-Type: application/json" \
  -d '{"csp-report":{"blocked-uri":"https://evil.com/script.js","document-uri":"https://example.com/test","violated-directive":"script-src"}}'

# Check CSP violation logs
sudo tail -f /var/log/apache2/csp-violations.log
Note: Use browser developer tools to test CSP in practice. The Console tab will show CSP violations in real-time, which is invaluable for debugging policy issues.

Common issues

SymptomCauseFix
Scripts not loadingCSP blocks inline or external scriptsAdd script sources to script-src directive or use nonces
Styles not applyingCSP blocks inline stylesUse external stylesheets or add 'unsafe-inline' to style-src
Images not displayingMissing image sources in CSPAdd image domains to img-src directive
HSTS not workingSite accessed over HTTPEnsure redirects to HTTPS and headers only sent over HTTPS
CSP reports not loggingIncorrect report-uri or permissionsCheck PHP file permissions and log directory writability
Headers module not loadedModule not enabledRun sudo a2enmod headers and restart Apache

Advanced CSP configuration

For production applications, consider these advanced CSP strategies for better security without breaking functionality.

Use nonces for inline scripts

Generate unique nonces for each request to allow specific inline scripts while blocking others. This provides better security than 'unsafe-inline'.

Automated install script

Run this to automate the entire setup

#apache #security-headers #content-security-policy #csp #web-security

Tutoriales relacionados

security Advanced

Implement Kubernetes security scanning with Falco and OPA Gatekeeper for runtime protection

Set up comprehensive Kubernetes security with Falco for runtime threat detection and OPA Gatekeeper for admission control policy enforcement. This tutorial covers installation, configuration, and custom security policies.

45 min 4 distros 357 views
security Advanced

Implement OpenResty rate limiting and DDoS protection with advanced Lua rules

Set up comprehensive rate limiting and DDoS protection for OpenResty using nginx directives, Redis-backed Lua middleware, and advanced security rules with monitoring and alerting.

45 min 4 distros 538 views
security Advanced

Configure Redis 7 cluster SSL encryption and authentication for production security

Secure your Redis 7 cluster with TLS encryption, client authentication, and inter-node SSL communication for production environments. Includes certificate generation, authentication setup, and security validation.

45 min 4 distros 525 views
Browse all tutorials in our complete directory →

¿Prefiere no gestionarlo usted mismo?

Gestionamos la infraestructura de empresas que dependen del tiempo de actividad. Totalmente gestionada, con un contacto fijo que conoce su entorno.

Tiene un contacto fijo que conoce su entorno

En su escritorio en Róterdam 15:19 · accesible por mensaje, sin formulario de tickets

+31 10 477 5362 WhatsApp