Topic: Header set X-XSS-Protection "1; mode=block" -- not

[alexjohnb]

I am having trouble getting the directive

Header set X-XSS-Protection "1; mode=block"

to have any effect.

My question:

In my websites various conf files, I have this stanza:

<IfModule mod_headers.c>
# Allow some urls, block all others; whitelisting
<LocationMatch ^((?!(xxxxxx)).)*$>
Header always append X-Frame-Options SAMEORIGIN
</LocationMatch>
Header always append X-Frame-Options "ALLOW-FROM http://xxxxxxxx.azurewebsites.net/"
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
Header set X-XSS-Protection "1; mode=block"
</IfModule>

Will the directive <IfModule mod_headers.c> take effect if

LoadModule headers_module modules/mod_headers.so

is in the httpd.conf file, or does it also have to be in any <VirtualHost> stanzas which make use of it? Or should it be

<IfModule headers_module>?

Please advise.

Many thanks.

[Steffen]

See http://httpd.apache.org/docs/2.4/en/mod/core.html#ifmodule