Setting Security Headers in Apache2

Security headers tell the browser to enforce protections on your behalf — a handful of lines in the Apache config add meaningful defense-in-depth against several common attack classes.

<IfModule mod_headers.c>
    # Prevent the site from being embedded in an iframe (clickjacking protection)
    Header always set X-Frame-Options "SAMEORIGIN"

    # Stop browsers from MIME-sniffing content types
    Header always set X-Content-Type-Options "nosniff"

    # Force HTTPS for all future requests, for a full year
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

    # Restrict what resources the page can load - customize per site
    Header always set Content-Security-Policy "default-src 'self'"

    # Control how much referrer info is sent to other sites
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

sudo a2enmod headers
sudo systemctl reload apache2

Test the result with securityheaders.com — it grades your actual response headers and flags anything missing, a fast way to verify these are genuinely being sent rather than trusting the config alone.