title: Setting headers in httpd.conf not setting headers in .htaccess
body: <p>I have a curious issue:</p>
  <p>I have a bunch of headers that are the same for every website on a server. I think &quot; <em>this can be set just once in <code>httpd.conf</code> so as to save writing out into a pile of .htaccess every time there's a new one to add / change.</em> &quot;</p>
  <p>So this is what I do;</p>
  <p>In the <code>httpd.conf</code> file <strong>before the virtual hosts</strong> I set:</p>
  <pre><code>&lt;IfModule mod_headers.c&gt;
    &lt;Directory '/'&gt;
  Header always set Feature-Policy &quot;accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'&quot;
  Header always set Cache-Control no-cache,must-revalidate
  Header always set X-Clacks-Overhead &quot;GNU Terry Pratchett&quot;
  Header always set X-XSS-Protection 1;mode=block
  Header always set X-Content-Type-Options nosniff
  Header always set X-Frame-Options SAMEORIGIN
  Header always set Content-Language en
  Header always set Referrer-Policy origin-when-cross-origin
  Header unset Last-Modified
  Header unset X-Powered-By
  Header always set Strict-Transport-Security &quot;max-age=31536000;&quot; &quot;expr=%{HTTPS} == 'on'&quot;
  Header always set Expect-CT enforce,max-age=2592000
    &lt;/Directory&gt;
  &lt;/IfModule&gt;
  </code></pre>
  <p>However, after doing this and hard restarting the Apache (version 2.4.37), I find that additional or edited <code>Header</code> instructions in the <code>.htaccess</code> are not being sent.</p>
  <p>For example; each account has its own CSP policy and this is reflected in the account <code>public_html/.htaccess</code> file:</p>
  <p><em>example:</em></p>
  <pre><code>Header set Content-Security-Policy &quot;upgrade-insecure-requests; default-src 'self' https:;&quot;
  </code></pre>
  <p>But when the headers are read by any browser the headers recieved are only the ones from the httpd.conf and no addditional or changed headers are showing from the <code>.htaccess</code>.</p>
  <p>I can't work out why this is?</p>
  <h1>What have I tried</h1>
  <ul>
  <li>I have wrapped the headers in the <code>.htaccess</code> in qualifier <code>&lt;IfModule  ...&gt;</code> statements.</li>
  <li>I have used different browsers to force apache to reread the
  .htaccess files.</li>
  <li>I have read google and can find no reference of httpd.conf messing with htaccess reading of headers.</li>
  <li>Other parts to the <code>.Htaccess</code> files are being read ok.</li>
  </ul>
  <h1>Notes</h1>
  <ul>
  <li>Apache version 2.4.37</li>
  <li>All of these headers work in the <code>.htaccess</code> prior to the above changes. It's <em>not</em> Header syntax as far as I can tell.</li>
  </ul>
  <p>Any help gratefully received.</p>