# Security and Setup Warnings **URL:** \ **Category:** ℹ️ Support\ **Created:** [October 30, 2016, 4:35am UTC](https://help.nextcloud.com/t/security-and-setup-warnings/4658 "2016-10-30T04:35:03Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![aussieute](https://help.nextcloud.com/user_avatar/help.nextcloud.com/aussieute/32/1204_2.png) [@aussieute](https://help.nextcloud.com/u/aussieute)\ **Post date:** [October 30, 2016, 4:35am UTC](https://help.nextcloud.com/t/security-and-setup-warnings/4658/1 "2016-10-30T04:35:03Z")
New Install and now two issues **1. Security & setup warnings** I get the following errors ``` The "X-XSS-Protection" HTTP header is not configured to equal to "1; mode=block". This is a potential security or privacy risk and **we recommend adjusting this setting.** The "X-Content-Type-Options" HTTP header is not configured to equal to "nosniff". This is a potential security or privacy risk and **we recommend adjusting this setting**. The "X-Robots-Tag" HTTP header is not configured to equal to "none". This is a potential security or privacy risk and **we recommend adjusting this setting.** The "X-Frame-Options" HTTP header is not configured to equal to "SAMEORIGIN". This is a potential security or privacy risk and **we recommend adjusting this setting.** The "X-Download-Options" HTTP header is not configured to equal to "noopen". This is a potential security or privacy risk and **we recommend adjusting this setting.** The "X-Permitted-Cross-Domain-Policies" HTTP header is not configured to equal to "none". This is a potential security or privacy risk and **we recommend adjusting this setting.** ``` Really useful except there are no pointers as to where to adjust these settings Any pointers? 1. Unable to upgrade. Maybe as a result of the above Logging into browser says I need to upgrade and provides this link. > **[ownCloud Documentation Overview](https://doc.owncloud.com/)** > > ownCloud Documentation Overview **Version** Nextcloud 10.0 (stable) I’m also told that … A new version is available: ownCloud 9.1.1 Thanks ---
**Author:** ![anon58843897](https://help.nextcloud.com/letter_avatar/anon58843897/32/6_22734026db12803ebb3e059622ac3534.png) [@anon58843897](https://help.nextcloud.com/u/anon58843897)\ **Post date:** [October 30, 2016, 8:14am UTC](https://help.nextcloud.com/t/security-and-setup-warnings/4658/2 "2016-10-30T08:14:32Z")
> [@aussieute](#): > > Really useful except there are no pointers as to where to adjust these settings > Any pointers? The headers are set in the .htaccess file that ships with Nextcloud. If you’re using a different web server such as Nginx, you would need to set the headers in the web server configuration. > [@aussieute](#): > > I’m also told that … A new version is available: ownCloud 9.1.1 This is a known issue. See [Notification about an "upgrade" to ownCloud 9.1.1 in Nextcloud 10 stable](https://help.nextcloud.com/t/notification-about-an-upgrade-to-owncloud-9-1-1-in-nextcloud-10-stable/4573) ---
**Author:** ![aussieute](https://help.nextcloud.com/user_avatar/help.nextcloud.com/aussieute/32/1204_2.png) [@aussieute](https://help.nextcloud.com/u/aussieute)\ **Post date:** [November 1, 2016, 10:38am UTC](https://help.nextcloud.com/t/security-and-setup-warnings/4658/3 "2016-11-01T10:38:18Z")
Thanks grouchysysadmin Ok so I have to edit the .htaccess? Why isn’t the .htaccess in the install configured by default? I’ve checked and all the alerts are set as indicated. Hmm weird Manual upgrade requires command line access from my reading which I don’t have Any way around this? Thanks ---
**Author:** ![anon58843897](https://help.nextcloud.com/letter_avatar/anon58843897/32/6_22734026db12803ebb3e059622ac3534.png) [@anon58843897](https://help.nextcloud.com/u/anon58843897)\ **Post date:** [November 1, 2016, 12:13pm UTC](https://help.nextcloud.com/t/security-and-setup-warnings/4658/4 "2016-11-01T12:13:33Z")
You should not need to edit the .htaccess file. The default that ships with Nextcloud has the proper settings in it. Is your web hosting running Apache? If so, does it allow setting headers from the .htaccess file? A manual upgrade can be done by deleting the files through FTP, and then uploading the new Nextcloud version. Then you can run the upgrade script from the browser. I can’t say I recommend it, but it should work. My advice is to find a hosting plan that provides SSH access. Nextcloud is a lot easier to work with if you have access to the occ command. ---
**Author:** ![aussieute](https://help.nextcloud.com/user_avatar/help.nextcloud.com/aussieute/32/1204_2.png) [@aussieute](https://help.nextcloud.com/u/aussieute)\ **Post date:** [February 25, 2017, 11:11pm UTC](https://help.nextcloud.com/t/security-and-setup-warnings/4658/5 "2017-02-25T23:11:58Z")
Just Upgraded to Nextcloud 11.0.1 (stable) All good and functioning as it should anon58843897 you said I should not need to edit .htaccess. The .htaccess in the latest install is … ``` # line below if for Apache 2.4 Require all denied # line below if for Apache 2.2 deny from all # section for Apache 2.2 and 2.4 IndexIgnore * ``` Admin errors continue … - The “X-XSS-Protection” HTTP header is not configured to equal to “1; mode=block”. This is a potential security or privacy risk and we recommend adjusting this setting. - The “X-Content-Type-Options” HTTP header is not configured to equal to “nosniff”. This is a potential security or privacy risk and we recommend adjusting this setting. - The “X-Robots-Tag” HTTP header is not configured to equal to “none”. This is a potential security or privacy risk and we recommend adjusting this setting. - The “X-Frame-Options” HTTP header is not configured to equal to “SAMEORIGIN”. This is a potential security or privacy risk and we recommend adjusting this setting. - The “X-Download-Options” HTTP header is not configured to equal to “noopen”. This is a potential security or privacy risk and we recommend adjusting this setting. - The “X-Permitted-Cross-Domain-Policies” HTTP header is not configured to equal to “none”. This is a potential security or privacy risk and we recommend adjusting this setting. ---
**Author:** ![earth](https://help.nextcloud.com/letter_avatar/earth/32/6_22734026db12803ebb3e059622ac3534.png) [@earth](https://help.nextcloud.com/u/earth)\ **Post date:** [February 26, 2017, 9:14am UTC](https://help.nextcloud.com/t/security-and-setup-warnings/4658/6 "2017-02-26T09:14:08Z")
U need to add this in nginx (nextcloud.conf) Search install nextcloud with nginx n u will ur problem solved ---
**Author:** ![aussieute](https://help.nextcloud.com/user_avatar/help.nextcloud.com/aussieute/32/1204_2.png) [@aussieute](https://help.nextcloud.com/u/aussieute)\ **Post date:** [March 15, 2017, 8:25pm UTC](https://help.nextcloud.com/t/security-and-setup-warnings/4658/7 "2017-03-15T20:25:40Z")
Error post and can’t remove ---
**Author:** ![aussieute](https://help.nextcloud.com/user_avatar/help.nextcloud.com/aussieute/32/1204_2.png) [@aussieute](https://help.nextcloud.com/u/aussieute)\ **Post date:** [March 15, 2017, 8:29pm UTC](https://help.nextcloud.com/t/security-and-setup-warnings/4658/8 "2017-03-15T20:29:54Z")
earth now you really have me confused. Just downloaded 11.0.2 and checked as I’ve updated and the errors still persist. The .htaccess hasn’t changed and neither have the errors. So earth your comment “U need to add this in nginx (nextcloud.conf)” means add what to the extcloud.conf? The contents of the config file? I am still at a loss that the default .htaccess causes all these errors, let alone requiring additional editing. ---
**Author:** ![earth](https://help.nextcloud.com/letter_avatar/earth/32/6_22734026db12803ebb3e059622ac3534.png) [@earth](https://help.nextcloud.com/u/earth)\ **Post date:** [March 16, 2017, 3:16am UTC](https://help.nextcloud.com/t/security-and-setup-warnings/4658/9 "2017-03-16T03:16:09Z")
are you using apache or nginx? what is the error? if your error are same as stated in post 5 and if you are using nginx than try to modify your nginx with the ones stated in below mentioned sites > **[Install Nextcloud 9 on Ubuntu 16.04](https://www.rosehosting.com/blog/install-nextcloud-on-ubuntu-16-04/)** > > In this article, we will show you how to install Nextcloud 9 on an Ubuntu 16.04 VPS with MariaDB, PHP-FPM 7.0 and Nginx. Nextcloud is open source self-hosted file sync and share application forked from ownCloud. This guide should work on other Linux... > **[Setup OwnCloud 9 Server with Nginx, MariaDB and PHP7 on Debian](https://www.linuxbabe.com/linux-server/setup-owncloud-9-server-nginx-mariadb-php7-debian)** > > This tutorial explains how to setup ownCloud 9.0 server on a Debian 8 VPS with Nginx, MariaDB and PHP7. ownCloud installation is very similar to WordPress. Please compare yout nextcloud conf with the one stated here, you will get your error solve. ---
**Author:** ![aussieute](https://help.nextcloud.com/user_avatar/help.nextcloud.com/aussieute/32/1204_2.png) [@aussieute](https://help.nextcloud.com/u/aussieute)\ **Post date:** [March 16, 2017, 8:56am UTC](https://help.nextcloud.com/t/security-and-setup-warnings/4658/10 "2017-03-16T08:56:41Z")
On SiteGround - Apache Downloaded the latest and nothing is different with the errors since Version 9. ---
**Author:** ![theskyisgrey](https://help.nextcloud.com/letter_avatar/theskyisgrey/32/6_22734026db12803ebb3e059622ac3534.png) [@theskyisgrey](https://help.nextcloud.com/u/theskyisgrey)\ **Post date:** [May 13, 2017, 12:44pm UTC](https://help.nextcloud.com/t/security-and-setup-warnings/4658/11 "2017-05-13T12:44:18Z")
I’m on Siteground too and have the same errors. Did you get the problem fixed? In the .htaccess file I have the lines that I guess are supposed to set these parameters. Does this mean it is a configuration issue with Siteground? # Add security and privacy related headers Header set X-Content-Type-Options "nosniff" Header set X-XSS-Protection "1; mode=block" Header set X-Robots-Tag "none" Header set X-Frame-Options "SAMEORIGIN" Header set X-Download-Options "noopen" Header set X-Permitted-Cross-Domain-Policies "none" SetEnv modHeadersAvailable true # Add cache control for static resources \ Header set Cache-Control “max-age=15778463” ---
**Author:** ![system](https://help.nextcloud.com/user_avatar/help.nextcloud.com/system/32/29333_2.png) [@system](https://help.nextcloud.com/u/system)\ **Post date:** [September 23, 2024, 6:16pm UTC](https://help.nextcloud.com/t/security-and-setup-warnings/4658/12 "2024-09-23T18:16:28Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed. ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [December 9, 2024, 12:29pm UTC](https://help.nextcloud.com/t/security-and-setup-warnings/4658/13 "2024-12-09T12:29:44Z")