Skip to main content

How to manage X-Frame-Options through .htaccess for your website

William Lam
  • Updated

Question

How to manage X-Frame-Options through .htaccess for your website

Answer

CPANEL_WARN: Please note cPanel is unable to assist with making these modifications.

Globally
  1. Access your WHM server as the root user and navigate to Home / Server Configuration / Terminal

  2. Run the following commands.

    CPANEL_INFO: Replacing cpanelusername and domain.tld with your cPanel user and domain. Additionally, the "include" in "include.conf" can be changed, but the files are loaded in alphabetical order.

    # mkdir -p /etc/apache2/conf.d/userdata/ssl/2_4/cpanelusername/domain.tld/
    mkdir -p /etc/apache2/conf.d/userdata/std/2_4/cpanelusername/domain.tld/
    touch /etc/apache2/conf.d/userdata/ssl/2_4/cpanelusername/domain.tld/include.conf
    touch /etc/apache2/conf.d/userdata/std/2_4/cpanelusername/domain.tld/include.conf

  3. Edit the newly created files and add the following.

    CONFIG_TEXT: <ifModule mod_headers.c>
    Header set Strict-Transport-Security "max-age=31536000" env=HTTPS
    Header always set X-Frame-Options "sameorigin"
    </ifModule>

  4. Rebuild the Apache configuration to add the includes with this command:

    # /usr/local/cpanel/scripts/rebuildhttpdconf

  5. Restart Apache so it reads the new configuration.

    # /usr/local/cpanel/scripts/restartsrv_httpd

Individually through .htaccess
  1. Access your cPanel account.
  2. Locate and open File Manager.
  3. Select the folder your .htaccess is in, usually public_html.
  4. Select the .htaccess file and edit the file.

  5. Add the following.

    CONFIG_TEXT: <ifModule mod_headers.c>
    Header set Strict-Transport-Security "max-age=31536000" env=HTTPS
    Header always set X-Frame-Options "deny"
    Header setifempty Referrer-Policy: same-origin
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Permitted-Cross-Domain-Policies "none"
    Header set Referrer-Policy "no-referrer"
    Header set X-Content-Type-Options: nosniff
    </ifModule>

  6. Save your changes.

Confirm this is working by running this command, replacing domain.tld with your domain.

# curl -s --head -D- https://domain.tld/ | egrep -i 'strict|location|powered|sameorigin|deny'

Additional Resources

How to use Apache includes to add configuration directives to a specific domain's virtualhost

Related articles

Comments

0 comments

Article is closed for comments.

%