title: .htaccess headers being ignored by Apache
body: <p>I have a website that uses the same core <code>.htaccess</code> details as many other websites; however this website does not properly load the <code>.htaccess</code> directives -- giving a basic HTTP header set of:</p>
  <pre><code>    HTTP/1.1 200 OK
      Date: Mon, 12 Nov 2018 09:34:28 GMT
      Server: Apache
      Keep-Alive: timeout=5, max=100
      Connection: Keep-Alive
      Transfer-Encoding: chunked
      Content-Type: text/html; charset=UTF-8
  </code></pre>
  <p>The website itself loads fine, but additonal headers in .htaccess are not being agknowledged / loaded.</p>
  <h1>So <code>.htaccess</code> is being read, right?</h1>
  <p>Yes -- The htaccess file contains HTTPS forced redirects and domain name redirects (from the .co.uk to .com address (both to the same website account))</p>
  <p>These work.</p>
  <h1>Headers supplied by PHP are being loaded fine, too</h1>
  <p>The PHP headers on a test page are loading just fine:</p>
  <pre><code>&lt;?php
  header(&quot;Cache-Control: no-cache, must-revalidate&quot;);
  header('Content-Type: text/html; charset=utf-8');
  header(&quot;X-Clacks-Overhead: GNU Terry Pratchett&quot;);
  header(&quot;Content-Language: en&quot;);
  header(&quot;X-XSS-Protection: 1; mode=block&quot;);
  header(&quot;X-Frame-Options: SAMEORIGIN&quot;);
  header(&quot;X-Content-Type-Options: nosniff&quot;);
  ?&gt;
  </code></pre>
  <p>But the same headers set in the <code>.htaccess</code> are not being agknowledged.</p>
  <h1>So it's an <code>.htaccess</code> syntax error!</h1>
  <p>Not that I can see; usually with a .htaccess <em>error</em> the site loads an HTTP-500 error message, however here the site loads in the browser without issue.</p>
  <p>When there <em>IS</em> a deliberate syntax error the error-500 HTTP response comes back as expected.</p>
  <h1>Ok bozo, check your error logs!</h1>
  <p>Absolutely; I couldn't agree more. The Apache error logs are empty!</p>
  <h1>What have you tried to do to fix this?</h1>
  <ul>
  <li>Confirmed <code>httpd.conf</code> allows reading of <code>.htaccess</code></li>
  <li>Confirmed that mod_headers.c is loaded on the server</li>
  <li>Commented out and re-written various rules, to no effect</li>
  <li>Read lots (maybe 6-8) of posts on Stack Overflow and <a href="https://serverfault.com/questions/842808/apache-ignoring-htaccess">Server Fault</a> - Stackoverflow posts don't appear to relate or their issues had distinct differences.</li>
  <li>Confirmed my <code>.htaccess</code> has the correct permissins (0644)</li>
  <li>Told my staff (He's a Graphic Designer).</li>
  <li>Cried myself to sleep.</li>
  </ul>
  <h1>Right then - Get your file out! Show me the magic!</h1>
  <p>Here:</p>
  <pre><code>Options +FollowSymLinks
  Options -Indexes
  RewriteEngine On
  ErrorDocument 404 /index.php?msg=404
  ErrorDocument 403 /index.php?msg=403
  
  #Set asset items to cache for 1 week.
  &lt;FilesMatch &quot;\.(gif|jpe?g|png|ico|css|js|swf|mp3)$&quot;&gt;
       Header set Cache-Control &quot;max-age=1972800, public, must-revalidate&quot;
  &lt;/FilesMatch&gt;
  
  RewriteCond %{HTTPS} !=on
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  
  ## This does not appear to work (for either)
  #Header always set Strict-Transport-Security &quot;max-age=31536000;&quot; env=HTTPS
  Header always set Strict-Transport-Security &quot;max-age=31536000; includeSubdomains;&quot; &quot;expr=%{HTTPS} == 'on'&quot;
  Header set Expect-CT enforce,max-age=2592000
  
  RewriteCond %{HTTP_HOST} ^(www\.)?thewebsite\.co\.uk$ [NC]
  RewriteRule ^/?(.*)$ https://www.thewebsite.com%{REQUEST_URI} [R=301,L]
  
  ###
  ##### Seems to workdown to roughly this point.
  ###
  
  #force requests to begin with a slash.
  RewriteCond  %{REQUEST_URI}  !^$
  RewriteCond  %{REQUEST_URI}  !^/
  RewriteRule  .*              -    [R=403,L]
  
  RewriteCond %{HTTP_HOST} !^$
  RewriteCond %{HTTP_HOST} !^www\. [NC]
  RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
  
  RewriteCond %{ENV:REDIRECT_STATUS} 200
  RewriteRule .* - [L]
  
  ### This file does not exist on the directory at present. 
  &lt;Files .account-user.ini&gt;
      order allow,deny
      deny from all
  &lt;/Files&gt;
  
  ###
  #### None of these appear on assessment tools such as Security Headers 
  #### Or redbot.
  ###
  Header set Cache-Control no-cache,must-revalidate
  Header set X-Clacks-Overhead &quot;GNU Terry Pratchett&quot;
  Header set X-XSS-Protection 1;mode=block
  Header set X-Content-Type-Options nosniff
  Header always set X-Frame-Options SAMEORIGIN
  Header set Expect-CT enforce,max-age=2592000
  Header set Content-Language en
  Header set Referrer-Policy origin-when-cross-origin
      
  &lt;LimitExcept GET POST HEAD&gt;
      deny  from all
  &lt;/LimitExcept&gt;
  </code></pre>
  <h1>And finally it would really help if you gave me a final summary of all of the above!</h1>
  <ul>
  <li>Header setting commands in <code>.htaccess</code> do not appear to work.</li>
  <li><strong>ALL</strong> parts of the file are used on other live sites elsewhere without issue.</li>
  <li>Headers can be set in PHP without issue</li>
  <li>No errors arise from these Headers in the <code>.htaccess</code>.</li>
  <li>Headers appear to fail silently.</li>
  <li>No Apache error logs are recorded.</li>
  <li>The <code>.htaccess</code> <strong>is</strong> being read by Apache because other commands (such as <code>mod_Rewrite</code>s) <em>are</em> being actioned</li>
  </ul>
  <hr />
  <h1>UPDATE:</h1>
  <p>From research by other parties (the hosting providers) it seems that somehow the <code>.htaccess</code> works and loads all the correct headers <em>for non PHP pages</em>.</p>
  <p>For even plain PHP pages; the headers are blank.</p>
  <p><strong>Clarification</strong></p>
  <ul>
  <li>whatever.html pages load the headers all ok.</li>
  <li>PHP pages display headers set by <code>Header(&quot;...&quot;);</code></li>
  <li>PHP pages refuse to load any headers set by <code>.htaccess</code>. This is the problem.</li>
  </ul>
  <blockquote>
  <h1>So it <em>looks like</em> my <code>.htaccess</code> can't set headers for PHP pages. How can I fix this?</h1>
  </blockquote>