I transferred my WordPress website from a hosting company to a virtual machine. I want to add some security scripts like X-Frame, CSP, and HSTS. Before that, I edited the .htaccess file from the cPanel and it worked well. Now, I added the same script in the current .htaccess file in the VM but when I check with this site X-Frame Online Check, I received a "Couldn't find X-Frame" message.

Couldn't find the X-Frame-Options headers in the response headers.

This is my .haccess file:

<IfModule mod_headers.c>
    Header set X-Frame-Options "SAMEORIGIN"

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDo>

# BEGIN WordPress
# The directives (lines) between "BEGIN WordPress" and "END WordPress" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

How can I find the problem and trace this issue?

  • Is mod_headers installed? You should remove the <IfModule mod_headers.c> wrappers. There is certainly an error in the STS header line (it's truncated). You are missing the closing </IfModule>. Are inner WordPress pages working OK using pretty permalinks?
    – MrWhite
    Commented Jun 12, 2023 at 8:49
  • "This is my .haccess file:" - Best check... this is just a typo in your question and not a typo in the filename?!
    – MrWhite
    Commented Jun 12, 2023 at 9:10

1 Answer 1


Some steps to troubleshoot:

  1. Is the htaccess working? Perhaps your Apache server has a AllowOverride None directive. A simple test would be to enter some erroneous code, like XYZ and see if it throws an error.
  2. Do you have mod_headers installed? As Per MrWhite's suggestion, remove the IfModule mod_headers.c and see if it throws an error.
  3. I noticed that there's a typo on your HSTS header. Also know that you can combine several into a single block. Try replacing both of your header statements with the following (I've added a few common ones):
<IfModule mod_headers.c>
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-Content-Type-Options "nosniff"
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
    Header set Referrer-Policy "same-origin"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.