# Http security headers in .htaccess

**URL:** <https://community.localwp.com/t/http-security-headers-in-htaccess/47323>\
**Category:** Support\
**Tags:** mac\
**Created:** [March 7, 2025, 5:09pm UTC](https://community.localwp.com/t/http-security-headers-in-htaccess/47323 "2025-03-07T17:09:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fredericm](https://sea1.discourse-cdn.com/flex019/user_avatar/community.localwp.com/fredericm/32/15695_2.png) [@fredericm](https://community.localwp.com/u/fredericm)\
**Post date:** [March 7, 2025, 5:09pm UTC](https://community.localwp.com/t/http-security-headers-in-htaccess/47323/1 "2025-03-07T17:09:40Z")

</div>

### What issue or error are you experiencing?

## I’ve put these lines in the .htaccess file: Header set Strict-Transport-Security “max-age=31536000” env=HTTPS Header set X-XSS-Protection “1; mode=block” Header set X-Content-Type-Options nosniff Header set X-Frame-Options DENY Header set Referrer-Policy: no-referrer-when-downgrade When I then inspect the page header, none of these lines are taken into account, even though they are on my real site. Why

### What steps can be taken to replicate the issue? Feel free to include screenshots, videos, etc

## On Local I have choosen Apache PHP 8.3.11. All works fine but after I put these lines I quit WP ans Local and restart. Nothing change in the header

### System Details

- **Local Version:**  
Version 9.2.2+6771
- **Operating System (OS) and OS version:**  
iMac M3 Sequoia 15.3.1

* * *

### Local Logs

Attach your Local Logs here ([Help Doc - Retrieving Local’s Log](https://localwp.com/help-docs/troubleshooting/retrieving-locals-log-file/))  
No error in log files Apache or PHP

* * *

_ **Security Reminder** _  
Local does a pretty good job of scrubbing private info from the logs and the errors it produces, however there’s always the possibility that something private can come through. Because these are public forums, always review the screenshots you are sharing to make sure there isn’t private info like passwords being displayed.

---

<div class="post-metadata">

**Author:** ![fredericm](https://sea1.discourse-cdn.com/flex019/user_avatar/community.localwp.com/fredericm/32/15695_2.png) [@fredericm](https://community.localwp.com/u/fredericm)\
**Post date:** [March 8, 2025, 9:41am UTC](https://community.localwp.com/t/http-security-headers-in-htaccess/47323/2 "2025-03-08T09:41:21Z")

</div>

So I have found this solution here and it works for me:

> [@'mod\_headers' not working in Mac](https://community.localwp.com/t/mod-headers-not-working-in-mac/23585/2):
>
> Update: I manually added the following line in /Local Sites/Test/conf/apache/modules.conf.hbs and it worked. LoadModule headers\_module "{{ modules }}/mod\_headers.so"

This line must be added in conf/apache/modules.conf.hbs

---

<div class="post-metadata">

**Author:** ![Nick-B](https://sea1.discourse-cdn.com/flex019/user_avatar/community.localwp.com/nick-b/32/16140_2.png) [@Nick-B](https://community.localwp.com/u/Nick-B)\
**Post date:** [March 10, 2025, 1:03pm UTC](https://community.localwp.com/t/http-security-headers-in-htaccess/47323/3 "2025-03-10T13:03:29Z")

</div>

Thank you for sharing @fredericm!

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/community.localwp.com/system/32/1_2.png) [@system](https://community.localwp.com/u/system)\
**Post date:** [March 12, 2025, 1:03am UTC](https://community.localwp.com/t/http-security-headers-in-htaccess/47323/4 "2025-03-12T01:03:49Z")

</div>

This topic was automatically closed 36 hours after the last reply. New replies are no longer allowed.