---
description: How to add a Content Security Policy header in Apache with mod_headers, and why you want the always condition.
---

# Apache

Apache sets response headers with `mod_headers`, and for a CSP you almost always want `Header always set` rather than the default. The difference decides whether your error pages carry a policy or not.

## What Apache gives you

- The `Header` directive, which can set, append, merge or remove response headers, applied after the content handler and output filters run.
- An optional condition argument: `onsuccess` (the default, and can be omitted) or `always`. Headers in the `always` table are added even on error responses and persist across internal redirects such as `ErrorDocument` handlers.
- `Header` usable in the main config, virtual hosts, directories and `.htaccess`, so the policy can be scoped.

## Setting the header

Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

```apache
Header always set Content-Security-Policy-Report-Only "default-src 'none'; form-action 'none'; frame-ancestors 'none'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly"
```

That is the same starting policy we recommend for the [CSP Wizard](/setup/wizard/), and report-only blocks nothing.

## Things to watch for

- Without `always`, an `ErrorDocument` handler or an internal redirect can return a page with no policy on it. Error pages are still pages, and they still run scripts.
- `Header set` replaces; `Header append` and `Header merge` add to an existing value. If a proxy or application further up is already sending a CSP, `set` at the wrong layer will mask it and `append` will produce a policy that is the intersection of both - neither is usually what was intended. Check what leaves the origin first.
- Apache cannot generate a per-request nonce without `mod_lua` or similar. Allowlist and hash-based policies work fine; nonce-based policies belong in the application.

## Official documentation

[Apache HTTP Server - mod_headers](https://httpd.apache.org/docs/current/mod/mod_headers.html)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page. Prefer a guided setup? The [CSP Wizard](/setup/wizard/) builds a policy from your reports automatically once you're signed in.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)