# Modifying HTTP headers using .htaccess file

> Add, change or remove HTTP response headers with .htaccess for better security, caching control or debugging.

Source: https://helpcenter.ruachost.com/developers/web-servers/modifying-http-headers-using-htaccess-file/

Apache allows you to customize HTTP response headers using the `.htaccess` file. On **ruachost.com**, this is useful for improving security, controlling caching, and adding custom metadata to responses.

## Why Modify HTTP Headers?

- **Security**: Add headers like `X-Frame-Options` or `Content-Security-Policy`.
- **Caching**: Control how browsers store and reuse content.
- **Debugging**: Insert custom headers for testing.
- **Compliance**: Ensure headers meet regulatory requirements.

## Enabling Header Control

The Apache configuration on **ruachost.com** servers includes the **mod_headers** module. This allows you to add, edit, or remove headers directly in `.htaccess`.

## Adding a Header

Use the `Header set` or `Header append` directives:

```

    Header set X-Powered-By "Ruachost"
    Header append Cache-Control "public"

```

- `Header set` → creates or replaces a header.
- `Header append` → adds to an existing header value.

## Editing a Header

Use the `Header edit` directive with regular expressions:

```

    Header set Animal monkey
    Header append Animal camel
    Header edit Animal "camel" "llama"

```

Resulting header:

```
Animal: monkey, llama
```

???? Use `Header always edit` if you need to modify headers generated by applications (e.g., WordPress, Drupal).

## Removing a Header

To completely remove a header:

```

    Header unset Server

```

> **Best Practices:**
- Always wrap directives in `` to avoid errors if the module is disabled.
- Test changes using browser developer tools or `curl -I https://yourdomain.com`.
- Avoid exposing sensitive information in headers.
- Use permanent changes (`Header always`) when modifying application‑generated headers.