Custom Headers on OpenLiteSpeed

Adding Custom HTTP Headers in OLS

Custom HTTP headers are used for security, caching control, CORS, and more. On OpenLiteSpeed, headers are added via the extraHeaders directive in the vhost configuration or via context blocks.

Adding Headers in vhconf.conf

Edit your vhost config at /usr/local/lsws/conf/vhosts/YOUR_DOMAIN/vhconf.conf. Add headers in the context / block:

context / {
  location        /home/YOUR_DOMAIN/public_html/
  allowBrowse     1
  extraHeaders    <<<END_extraHeaders
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  END_extraHeaders
}

Essential Security Headers

Header	Value	Purpose
X-Content-Type-Options	nosniff	Prevents MIME type sniffing
X-Frame-Options	SAMEORIGIN	Prevents clickjacking
X-XSS-Protection	1; mode=block	Enables browser XSS filter
Strict-Transport-Security	max-age=31536000; includeSubDomains	Forces HTTPS for 1 year
Referrer-Policy	strict-origin-when-cross-origin	Controls referer information
Content-Security-Policy	(varies)	Controls resource loading

CORS Headers

To allow cross-origin requests (e.g., for a font CDN or API):

Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS"
Header always set Access-Control-Allow-Headers "Content-Type, Authorization"

Replace * with a specific origin for security in production.

Cache-Control Headers

Override browser cache behavior for specific content types:

# In a context block for static files
context /wp-content/uploads {
  location        /home/YOUR_DOMAIN/public_html/wp-content/uploads/
  allowBrowse     1
  extraHeaders    <<<END_extraHeaders
  Header set Cache-Control "public, max-age=31536000, immutable"
  END_extraHeaders
}

Verify Headers

curl -I https://YOUR_DOMAIN/ 2>/dev/null | grep -iE "x-frame|x-content|strict-transport|referrer"

After making changes, restart OLS: sudo systemctl restart lsws