Apache CSP Integration

Add CSP headers to your Apache configuration.

Prerequisites

Apache 2.2+ with mod_headers enabled
Access to httpd.conf, .htaccess, or virtual host configuration

Enable mod_headers

Ensure mod_headers is enabled:

# Debian/Ubuntu
sudo a2enmod headers
sudo systemctl restart apache2

# RHEL/CentOS
# Usually enabled by default, check httpd.conf

Quick Start

Add to your virtual host or .htaccess:

# Report-only mode (recommended to start)
Header set Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; report-uri https://ingest.headerhawk.com/csp/YOUR_SITE_ID"

Enforcement Mode

Once you’ve tuned your policy:

Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; report-uri https://ingest.headerhawk.com/csp/YOUR_SITE_ID"

Complete Example

<VirtualHost *:443>
    ServerName example.com
    DocumentRoot /var/www/html

    # CSP Header
    Header set Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://api.example.com; report-uri https://ingest.headerhawk.com/csp/YOUR_SITE_ID"

    # Other security headers
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "DENY"

    # SSL configuration
    SSLEngine on
    SSLCertificateFile /path/to/cert.pem
    SSLCertificateKeyFile /path/to/key.pem
</VirtualHost>

Configuration Options

Header Directives

Directive	Behavior
`Header set`	Sets header, overwriting any existing value
`Header append`	Appends to existing header
`Header add`	Adds header even if one already exists
`Header always set`	Sets header for all responses (including errors)

Using .htaccess

For directory-level configuration:

<IfModule mod_headers.c>
    Header set Content-Security-Policy-Report-Only "default-src 'self'; report-uri https://ingest.headerhawk.com/csp/YOUR_SITE_ID"
</IfModule>

Per-Directory Policies

<Directory /var/www/html/admin>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
</Directory>

<Directory /var/www/html/public>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'"
</Directory>

Troubleshooting

Headers Not Appearing

Check if mod_headers is enabled: apachectl -M | grep headers
Verify AllowOverride if using .htaccess
Check Apache error logs

Syntax Errors

Test configuration before restarting:

apachectl configtest

Verification

Test your configuration:

curl -I https://your-site.com | grep -i content-security-policy