Guides

How to add security headers via .htaccess

Security headers tell the browser how to handle your site safely: force HTTPS, block clickjacking, and control where scripts may load from. The easiest way to add them is through the .htaccess file if your site runs on Apache or LiteSpeed. It is a basic step that pushes your security grade to A+ in a few minutes.

1. Open .htaccess in the site root

   In cPanel open File Manager, turn on hidden files (Settings, then Show Hidden Files) and open .htaccess inside public_html. If the file is missing, create it with New File.

2. Enable HSTS

   Add the line Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains". It forces the browser to always use HTTPS. Only turn it on once the whole site and its subdomains already work over HTTPS.

3. Set X-Content-Type-Options and Referrer-Policy

   Add Header always set X-Content-Type-Options "nosniff" and Header always set Referrer-Policy "strict-origin-when-cross-origin". The first stops the browser from guessing file types, the second limits how much referrer data is sent to other sites.

4. Add clickjacking protection

   The line Header always set X-Frame-Options "SAMEORIGIN" prevents other sites from embedding yours in an iframe. For modern browsers, mirror it in CSP with the frame-ancestors 'self' directive.

5. Set Content-Security-Policy carefully

   Start with a soft policy such as Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data:; script-src 'self'". CSP can break your layout if you forget an external script or font, so list all your real sources first.

6. Wrap the directives in mod_headers

   To avoid a 500 error on servers without the module, wrap the block in <IfModule mod_headers.c> and </IfModule>. On typical LiteSpeed hosting the module is on, but the guard costs nothing.

7. Save the file and clear the cache

   Save .htaccess and, if LiteSpeed Cache or any other cache is active, purge it. The headers apply immediately, with no server restart.

How to verify the result

Open the site in an incognito window and check the headers in the browser Network tab, or run your domain through the TechGuard security headers checker, which shows a grade from A+ to F and which headers are still missing.

Tip: Do not add the preload directive to HSTS until HTTPS works across the entire domain, because rolling preload back is slow and painful.

Related guides

• How to remove an IP and domain from DNSBL blacklists