Http Header Management

From Joomla! Documentation

This page contains changes which are not marked for translation.

Other languages:
Deutsch • ‎English • ‎français • ‎italiano • ‎Nederlands
How to Use the New HTTP Header Management in Joomla 4.0

As of Joomla 4.0, Joomla introduced an HTTP Header Management System. This System is designed to help site owners to configure the HTTP Security Headers from the Backend

In this tutorial, you will find information on how to set up this new system on your site.


HTTP Headers (plg_system_httpheaders)

Navigate to System  Plugins  System - HTTP Headers to access the plugin configuration.

Plugin Configuration

From this page you can choose to enable that the headers are written to the server configuration files (.htaccess and web.config) and configure whether the following http headers are enabled

Using the "Force Header" form you can also force the following headers with its values:


Strict-Transport-Security (HSTS) Configuration

From this page you can choose to enable that the Strict-Transport-Security (HSTS) header as well as configure the max-age value whether subdomains should be included and whether you want to be added to the browsers Preload List.



Content Security Policy (com_csp)

Navigate to System  Content Security Policy to access the Content Security Policy Reports dashboard.


From this screen the Administrator has a global overview of the collected Content Security Policy reports and has the ability to review, publish, unpublish and delete suggested rules for the Content Security Policy directive.


To learn more, please see: Content Security Policy Interface


From this screen you can configure the options of the component like the permissions and specificly the settings for the Content-Security-Policy, including different modes and whether the headers are in read only mode.


To learn more, please see: Content Security Policy Options


Note: If you have configured some HTTP Security Headers directly on the server, then this Plugin might create double entries.

Check the output of your HTTP headers after configuring the HTTP Security Headers in the browser console. In Google Chrome: Inspect > Network > the output under Headers). In this Plugin you can disable the settings that cause double entries. Also check the Console of your browser for possible errors.

Extension Developers

As you might know the big security advantage concerning Content Security Policy jumps in when we can use the Header to block inline JavaScript and inline CSS. But we also know that it is still a requirement to have inline JavaScript and CSS, for that reason we have implemented an nonce support into our JavaScript and CSS APIs using this nonce we can still whitelist your inline JavaScript and CSS but still block any malicious ones to protect our sites.

In order that extensions still work even with strict Content Security Policy enabled, the easiest way is to use the Joomla API to apply your inline JavaScript and CSS, please check the examples below.

Adding JavaScript using the Joomla API

use Joomla\CMS\Factory;

// Add JavaScript from URL

// Add inline JavaScript
    window.event("domready", function() {
        alert("An inline JavaScript Declaration");

Adding CSS using the Joomla API

use Joomla\CMS\Factory;

// Add Style from URL

// Add inline Style
	body {
		background: #00ff00;
		color: rgb(0,0,255);

More details can be found here: