如何在Apache中配置安全头部信息防止XSS与点击劫持攻击

陆砚码
2026-10-27 • 👁 0人浏览过
设置X-Content-Type-Options和X-Frame-Options是为了防止MIME类型嗅探引发XSS及iframe点击劫持，二者是基础有效的安全防护，需全局配置、验证生效并避免被后端或CDN覆盖。为什么要设置
X-Content-Type-Options
和
X-Frame-Options
浏览器在解析响应时，若未明确声明内容类型或允许嵌入方式，可能触发 MIME 类型嗅探（导致 XSS）或被恶意页面用
</code></div>
套嵌（导致点击劫持）。这两个头部是防御链中最基础、最有效的环节，且 Apache 配置成本极低。
它们不依赖前端代码或框架中间件，直接由 Web 服务器注入，对静态资源、代理后端、甚至 CGI 脚本都生效。漏配会导致现代浏览器（Chrome/Firefox/Edge）主动降级安全策略，比如忽略
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">Content-Security-Policy</code></div>
的部分指令。
在 Apache 中启用
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">X-Content-Type-Options: nosniff</code></div>
该头部禁止浏览器尝试“猜测”响应的 MIME 类型，强制使用
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">Content-Type</code></div>
响应头指定的类型。常见踩坑点是：只加在 PHP 或 HTML 文件上，却忘了 JS/CSS/JSON 等静态资源同样可能被错误解析。
推荐在全局配置（如
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">/etc/apache2/apache2.conf</code></div>
或虚拟主机的
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto"><VirtualHost></code></div>
块内）添加：
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">Header always set X-Content-Type-Options "nosniff"</code></div>
确保已启用
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">headers</code></div>
模块：
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">a2enmod headers</code></div>
（Debian/Ubuntu）或确认
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">LoadModule headers_module modules/mod_headers.so</code></div>
已取消注释
若使用反向代理（如代理到 Node.js），需在代理配置中显式继承或重设该头，因为默认情况下
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">ProxyPass</code></div>
会丢弃原始响应头
防止点击劫持：正确配置
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">X-Frame-Options</code></div>
或迁移到
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">Content-Security-Policy</code></div>
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">X-Frame-Options</code></div>
是传统方案，但仅支持三种值：
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">DENY</code></div>
、
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">SAMEORIGIN</code></div>
、
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">ALLOW-FROM uri</code></div>
（后者已被 Chrome 79+ 和 Firefox 69+ 废弃）。实际部署中容易误用
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">ALLOW-FROM</code></div>
导致失效。
Apache 2.4.62
PHP中文网提供Apache 2.4.62 官方 tar.gz 源码包下载，通过源码编译安装，开发者能够灵活定制模块、优化性能并精准控制安装路径，满足多样化的业务需求。
下载
对绝大多数站点，直接设为
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">SAMEORIGIN</code></div>
最稳妥：
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">Header always set X-Frame-Options "SAMEORIGIN"</code></div>
若需兼容旧浏览器且允许特定域名嵌入，必须用
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">Content-Security-Policy</code></div>
替代：
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">Header always set Content-Security-Policy "frame-ancestors 'self' https://trusted.example.com;"</code></div>
注意：两个头部同时存在时，浏览器以更严格的策略为准；但
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">frame-ancestors</code></div>
会完全忽略
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">X-Frame-Options</code></div>
，所以二者共存无意义，建议逐步淘汰后者
验证是否生效及常见失败原因
配置后必须手动验证，不能只看 Apache 是否启动成功。典型失败场景不是语法错误，而是模块未加载、作用域错位或被后端覆盖。
用
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">curl -I https://yoursite.com/any-path</code></div>
检查响应头是否包含预期字段，特别注意路径是否匹配（例如只对
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">.php</code></div>
设置了头，但攻击者可利用
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">.html</code></div>
或无扩展名路径绕过）
如果使用 PHP-FPM，确认未在 PHP 脚本里用
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">header()</code></div>
覆盖了 Apache 设置的头（Apache 的
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">always</code></div>
修饰符可对抗部分覆盖，但无法覆盖
<div class="cxy-code-block"><button class="cxy-code-copy" aria-label="复制代码">复制</button><code class="language-auto">header_remove()</code></div>
）
CDN（如 Cloudflare）可能缓存旧响应或剥离自定义头，需检查 CDN 控制台是否启用了“Preserve original headers”或类似选项
真正麻烦的是混合部署：比如前端是 Vue SPA，后端是 Java，中间套了一层 Nginx 做负载均衡。这时候安全头得在最外层（Nginx）或至少统一入口处加，Apache 里的配置可能根本没机会生效。
                            </div>

                            <!-- 文章导航 -->
                            <nav class="phpwebsoft-article-nav" aria-label="文章导航">

    
                                <a href="http://www.phpwebsoft.com/news/31194.html" class="phpwebsoft-article-nav-link phpwebsoft-article-nav-prev">
                                    <span>&#8249;</span>
                                    <div>
                                        <div class="phpwebsoft-article-nav-label">上一篇</div>
                                        <div class="phpwebsoft-article-nav-title">小度路由怎么用 小度路由器设置图文教程</div>
                                    </div>
                                </a>
    


    
                                <a href="http://www.phpwebsoft.com/news/31253.html" class="phpwebsoft-article-nav-link phpwebsoft-article-nav-next">
                                    <div>
                                        <div class="phpwebsoft-article-nav-label">下一篇</div>
                                        <div class="phpwebsoft-article-nav-title">怎么在Apache中配置虚拟主机的独立日志文件方便故障分析</div>
                                    </div>
                                    <span>&#8250;</span>
                                </a>
    

                            </nav>
                        </div>
                    </article>

                    <!-- 相关文章列表 -->
                    <section class="phpwebsoft-content-section" style="margin-top: 20px;">
                        <h2 class="phpwebsoft-widget-title" style="margin-bottom: 20px;">相关文章</h2>
                        <ul class="phpwebsoft-article-list">

    
                            <li class="phpwebsoft-article-item">
                                <a href="http://www.phpwebsoft.com/news/31194.html" class="phpwebsoft-article-link">小度路由怎么用 小度路由器设置图文教程</a>
                                <div class="phpwebsoft-article-meta">2026-10-27</div>
                            </li>
    
                            <li class="phpwebsoft-article-item">
                                <a href="http://www.phpwebsoft.com/news/31175.html" class="phpwebsoft-article-link">TP-Link迷你路由器TL-WR700N/WR710N/WR800N图文设置方法(比较详细)</a>
                                <div class="phpwebsoft-article-meta">2026-10-27</div>
                            </li>
    
                            <li class="phpwebsoft-article-item">
                                <a href="http://www.phpwebsoft.com/news/31172.html" class="phpwebsoft-article-link">自家wifi的密码忘记了怎么查看</a>
                                <div class="phpwebsoft-article-meta">2026-10-27</div>
                            </li>
    
                            <li class="phpwebsoft-article-item">
                                <a href="http://www.phpwebsoft.com/news/30987.html" class="phpwebsoft-article-link">好看的yy马甲格式 yy马甲格式大全设计</a>
                                <div class="phpwebsoft-article-meta">2026-10-26</div>
                            </li>
    
                            <li class="phpwebsoft-article-item">
                                <a href="http://www.phpwebsoft.com/news/30979.html" class="phpwebsoft-article-link">Adobe AIR是什么意思？有什么作用</a>
                                <div class="phpwebsoft-article-meta">2026-10-26</div>
                            </li>
    
                            <li class="phpwebsoft-article-item">
                                <a href="http://www.phpwebsoft.com/news/30738.html" class="phpwebsoft-article-link">nginx与apache怎么限制ip并发访问</a>
                                <div class="phpwebsoft-article-meta">2026-10-26</div>
                            </li>
    
                            <li class="phpwebsoft-article-item">
                                <a href="http://www.phpwebsoft.com/news/30725.html" class="phpwebsoft-article-link">如何在Apache中通过mod_ssl配置SSLSessionCache实现跨进程的证书状态共享</a>
                                <div class="phpwebsoft-article-meta">2026-10-26</div>
                            </li>
    
                            <li class="phpwebsoft-article-item">
                                <a href="http://www.phpwebsoft.com/news/30723.html" class="phpwebsoft-article-link">《多洛可小镇》Steam试玩发布 国产小清新经营模拟</a>
                                <div class="phpwebsoft-article-meta">2026-10-26</div>
                            </li>
    
                            <li class="phpwebsoft-article-item">
                                <a href="http://www.phpwebsoft.com/news/31253.html" class="phpwebsoft-article-link">怎么在Apache中配置虚拟主机的独立日志文件方便故障分析</a>
                                <div class="phpwebsoft-article-meta">2026-10-27</div>
                            </li>
    
                            <li class="phpwebsoft-article-item">
                                <a href="http://www.phpwebsoft.com/news/31281.html" class="phpwebsoft-article-link">怎么给qq空间免费添加背景音乐</a>
                                <div class="phpwebsoft-article-meta">2026-10-27</div>
                            </li>
    

                        </ul>
                    </section>
                </div>

                <!-- 右侧边栏 -->
                <aside class="phpwebsoft-sidebar phpwebsoft-sidebar-right" aria-label="侧边栏">
    <!-- 推荐阅读 -->
    <div class="phpwebsoft-widget">
        <h3 class="phpwebsoft-widget-title">推荐阅读</h3>
        <div class="phpwebsoft-recommend-grid">

    
            <a href="http://www.phpwebsoft.com/news/31281.html" class="phpwebsoft-recommend-item">
                <div class="phpwebsoft-recommend-thumb">
                    <img src="http://www.phpwebsoft.com/static/v10/images/article-6.jpg" alt="怎么给qq空间免费添加背景音乐">
                </div>
                <div class="phpwebsoft-recommend-title">怎么给qq空间免费添加背景音乐</div>
            </a>
    
            <a href="http://www.phpwebsoft.com/news/31253.html" class="phpwebsoft-recommend-item">
                <div class="phpwebsoft-recommend-thumb">
                    <img src="http://www.phpwebsoft.com/static/v10/images/article-6.jpg" alt="怎么在Apache中配置虚拟主机的独立日志文件方便故障分析">
                </div>
                <div class="phpwebsoft-recommend-title">怎么在Apache中配置虚拟主机的独立日志文件方便故障分析</div>
            </a>
    
            <a href="http://www.phpwebsoft.com/news/31235.html" class="phpwebsoft-recommend-item">
                <div class="phpwebsoft-recommend-thumb">
                    <img src="http://www.phpwebsoft.com/static/v10/images/article-6.jpg" alt="如何在Apache中配置安全头部信息防止XSS与点击劫持攻击">
                </div>
                <div class="phpwebsoft-recommend-title">如何在Apache中配置安全头部信息防止XSS与点击劫持攻击</div>
            </a>
    
            <a href="http://www.phpwebsoft.com/news/31194.html" class="phpwebsoft-recommend-item">
                <div class="phpwebsoft-recommend-thumb">
                    <img src="http://www.phpwebsoft.com/static/v10/images/article-6.jpg" alt="小度路由怎么用 小度路由器设置图文教程">
                </div>
                <div class="phpwebsoft-recommend-title">小度路由怎么用 小度路由器设置图文教程</div>
            </a>
    

        </div>
    </div>

    <!-- 最新文章 -->
    <div class="phpwebsoft-widget">
        <h3 class="phpwebsoft-widget-title">最新文章</h3>
        <ul class="phpwebsoft-article-list">

    
            <li class="phpwebsoft-article-item">
                <a href="http://www.phpwebsoft.com/news/31281.html" class="phpwebsoft-article-link">怎么给qq空间免费添加背景音乐</a>
                <div class="phpwebsoft-article-meta">2026-10-27</div>
            </li>
    
            <li class="phpwebsoft-article-item">
                <a href="http://www.phpwebsoft.com/news/31253.html" class="phpwebsoft-article-link">怎么在Apache中配置虚拟主机的独立日志文件方便故障分析</a>
                <div class="phpwebsoft-article-meta">2026-10-27</div>
            </li>
    
            <li class="phpwebsoft-article-item">
                <a href="http://www.phpwebsoft.com/news/31235.html" class="phpwebsoft-article-link">如何在Apache中配置安全头部信息防止XSS与点击劫持攻击</a>
                <div class="phpwebsoft-article-meta">2026-10-27</div>
            </li>
    
            <li class="phpwebsoft-article-item">
                <a href="http://www.phpwebsoft.com/news/31194.html" class="phpwebsoft-article-link">小度路由怎么用 小度路由器设置图文教程</a>
                <div class="phpwebsoft-article-meta">2026-10-27</div>
            </li>
    
            <li class="phpwebsoft-article-item">
                <a href="http://www.phpwebsoft.com/news/31175.html" class="phpwebsoft-article-link">TP-Link迷你路由器TL-WR700N/WR710N/WR800N图文设置方法(比较详细)</a>
                <div class="phpwebsoft-article-meta">2026-10-27</div>
            </li>
    
            <li class="phpwebsoft-article-item">
                <a href="http://www.phpwebsoft.com/news/31172.html" class="phpwebsoft-article-link">自家wifi的密码忘记了怎么查看</a>
                <div class="phpwebsoft-article-meta">2026-10-27</div>
            </li>
    

        </ul>
    </div>

    <!-- 热门标签 -->
    <div class="phpwebsoft-widget">
        <h3 class="phpwebsoft-widget-title">热门标签</h3>
        <div class="phpwebsoft-article-tag-list">

    
            <a href="http://www.phpwebsoft.com/tag/1662" class="phpwebsoft-article-tag-item">apache</a>
    

        </div>
    </div>
</aside>
            </div>
        </div>
    </main>


    <!-- 页脚 -->
    <footer class="phpwebsoft-footer">
        <div class="phpwebsoft-container">
            <div class="phpwebsoft-footer-links" style="justify-content: center;">
                
                
                <a href="http://www.phpwebsoft.com/22.html" class="phpwebsoft-footer-link">免责声明</a>
                
                <a href="http://www.phpwebsoft.com/23.html" class="phpwebsoft-footer-link">关于我们</a>
                
                <a href="http://www.phpwebsoft.com/24.html" class="phpwebsoft-footer-link">联系我们</a>
                
                <a href="http://www.phpwebsoft.com/25.html" class="phpwebsoft-footer-link">投诉删除</a>
                
                <a href="http://www.phpwebsoft.com/26.html" class="phpwebsoft-footer-link">投稿须知</a>
                
                
            </div>
            <div class="phpwebsoft-footer-copyright" style="text-align: center; margin-top: 20px;">
                Copyright 2026
                 websoft网络软件专家
                版权所有
                 <a href="https://beian.miit.gov.cn/" rel="nofollow" target="_blank" style="color: inherit;">黔ICP备2025061481号</a>
            </div>
            <div style="text-align: center; margin-top: 10px; font-size: 12px; color: #999;">免责声明：本站信息来源于网络，仅供学习使用，版权归原作者所有，如有不愿意被转载的情况，请联系QQ：182111886，通知我们删除已转载的信息。</div>
        </div>
    </footer>

    <!-- 返回顶部按钮 -->
    <button class="phpwebsoft-back-to-top" id="backToTop" aria-label="返回顶部">&#8679;</button>

    <!-- 公共脚本 -->
    <script src="http://www.phpwebsoft.com/static/v10/js/common.js"></script>
    
    <div class="hide">
    </div>
</body>
</html>