Why does adding the following to the .htaccess file of my secure website cause an Error 500 (misconfiguration)?

Header set Content-Security-Policy: default-src https:; form-action https:; connect-src https: wss:; upgrade-insecure-requests

Note: mod_headers is loaded into the Apache server, according to phpinfo().

  • I think you need to put the header value in quotes if it contains spaces. I use it like this and it works: Header add Content-Security-Policy "default-src 'none'; ... upgrade-insecure-requests" (also not seperated with a colon between name and value) – Tobias K. Aug 24 '18 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.