Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using Apache 2.2 and want to set the X-Frame-Options header to "deny" across most of the site. I can turn it on unconditionally using mod_headers. However, there is one CGI scripts that returns content that has to be framed, so I need to turn it off for that script. Is there a way to do this?

I'm using Debian's Apache 2.2.9.

share|improve this question
up vote 4 down vote accepted

Try using the SetEnvIf directive, coupled with env in your Header directive:

SetEnvIf Request_URI "/MyCGI" is_cgi
Header set X-Frame-Options some-value env=!is_cgi

(or something close to that :-))

share|improve this answer

You can use the Location directive.

<Location /url/fragment/to/my/cgi/script>
  Header unset X-Frame-Options
share|improve this answer
I want "set header for everything EXCEPT this one CGI." I think your code does "set header for JUST this one CGI"? – user9876 Feb 3 '10 at 12:50
user9876, Sorry for the misunderstanding, I have updated the question – Rory Feb 3 '10 at 14:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.