# „X-Robots-Tag“-HTTP-Header not configured with „noindex, nofollow“ since NC 26.0.0

**URL:** <https://help.nextcloud.com/t/x-robots-tag-http-header-not-configured-with-noindex-nofollow-since-nc-26-0-0/158300>\
**Category:** ℹ️ Support\
**Tags:** setup\_warning, nc26\
**Created:** [March 22, 2023, 10:45am UTC](https://help.nextcloud.com/t/x-robots-tag-http-header-not-configured-with-noindex-nofollow-since-nc-26-0-0/158300 "2023-03-22T10:45:28Z")\
**Posts on this page:** 11\
**Page:** 2

<div class="post-metadata">

**Author:** ![crobarcro](https://help.nextcloud.com/user_avatar/help.nextcloud.com/crobarcro/32/7523_2.png) [@crobarcro](https://help.nextcloud.com/u/crobarcro)\
**Post date:** [May 30, 2024, 9:44pm UTC](https://help.nextcloud.com/t/x-robots-tag-http-header-not-configured-with-noindex-nofollow-since-nc-26-0-0/158300/21 "2024-05-30T21:44:25Z")

</div>

Would you mind explaining exactly how to solve this with apache2 please?

---

<div class="post-metadata">

**Author:** ![ernolf](https://help.nextcloud.com/user_avatar/help.nextcloud.com/ernolf/32/77874_2.png) [@ernolf](https://help.nextcloud.com/u/ernolf)\
**Post date:** [May 30, 2024, 11:49pm UTC](https://help.nextcloud.com/t/x-robots-tag-http-header-not-configured-with-noindex-nofollow-since-nc-26-0-0/158300/22 "2024-05-30T23:49:22Z")

</div>

> [@crobarcro](#):
>
> how to solve this with apache2

For apache2 there is a _`.htaccess`_ file with the “solution” so there is nothing to be done:

> <https://github.com/nextcloud/server/blob/48e62405021627914c7fc6dd58168e011cb0f574/.htaccess#L33C1-L35C1>

… unless you disabled _`.htaccess`_ by server configuration with

```auto
  AllowOverride None

```

* * *

ernolf

---

<div class="post-metadata">

**Author:** ![crobarcro](https://help.nextcloud.com/user_avatar/help.nextcloud.com/crobarcro/32/7523_2.png) [@crobarcro](https://help.nextcloud.com/u/crobarcro)\
**Post date:** [May 31, 2024, 11:14am UTC](https://help.nextcloud.com/t/x-robots-tag-http-header-not-configured-with-noindex-nofollow-since-nc-26-0-0/158300/23 "2024-05-31T11:14:40Z")

</div>

Thanks, the only AllowOverride statement I have is in my site configuration file like this:

```auto
  <Directory /var/www/nextcloud/>
    Require all granted
    AllowOverride All
    Options FollowSymLinks MultiViews

    <IfModule mod_dav.c>
      Dav off
    </IfModule>
  </Directory>

```

But I still see the warning in Nextcloud. I checked the .htaccess file in /var/www/nextcloud and it contains those directives. Any suggestions?

---

<div class="post-metadata">

**Author:** ![ernolf](https://help.nextcloud.com/user_avatar/help.nextcloud.com/ernolf/32/77874_2.png) [@ernolf](https://help.nextcloud.com/u/ernolf)\
**Post date:** [May 31, 2024, 11:21am UTC](https://help.nextcloud.com/t/x-robots-tag-http-header-not-configured-with-noindex-nofollow-since-nc-26-0-0/158300/24 "2024-05-31T11:21:52Z")

</div>

> [@crobarcro](#):
>
> Any suggestions?

The problem when using old topics, is that you did not provide any information about your system, your setup and your hosting environment.

Are you on a shared hoster?

It only works if the apache2 module _`mod_env`_ is loaded.

If you have got full access to your webserver, you could find out if _`mod_env`_ is loaded with this call

```auto
~$ sudo apachectl -M 2>/dev/null | grep env_module

```

it should echo this:

```auto
 env_module (shared)

```

* * *

Much and good luck,  
ernolf

---

<div class="post-metadata">

**Author:** ![crobarcro](https://help.nextcloud.com/user_avatar/help.nextcloud.com/crobarcro/32/7523_2.png) [@crobarcro](https://help.nextcloud.com/u/crobarcro)\
**Post date:** [June 1, 2024, 11:55pm UTC](https://help.nextcloud.com/t/x-robots-tag-http-header-not-configured-with-noindex-nofollow-since-nc-26-0-0/158300/25 "2024-06-01T23:55:11Z")

</div>

Thanks, yes the output of

```auto
sudo apachectl -M 2>/dev/null | grep env_module

```

is

```auto
env_module (shared)

```

In my case I am running nextcloud on my own server with a bare install (no containers). I’ve been running it this way since about NC 13, but the headers warning seems to be since upgrading to NC 29.

My full apache site config is below:

```auto
<IfModule mod_ssl.c>
<VirtualHost *:443>

  # enable HTTP/2
  Protocols h2 http/1.1

	# The ServerName directive sets the request scheme, hostname and port that
	# the server uses to identify itself. This is used when creating
	# redirection URLs. In the context of virtual hosts, the ServerName
	# specifies what hostname must appear in the request's Host: header to
	# match this virtual host. For the default virtual host (this file) this
	# value is not decisive as it is used as a last resort host regardless.
	# However, you must set it for any further virtual host explicitly.
	ServerName <redacted>
        <IfModule mod_headers.c>
                Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
        </IfModule>

	ServerAdmin sysadmin@<redacted>
	DocumentRoot /var/www/nextcloud

	<Directory /var/www/nextcloud/>
		Require all granted
		AllowOverride All
		Options FollowSymLinks MultiViews

		<IfModule mod_dav.c>
			Dav off
		</IfModule>
	</Directory>

	# For most configuration files from conf-available/, which are
	# enabled or disabled at a global level, it is possible to
	# include a line for only one particular virtual host. For example the
	# following line enables the CGI configuration for this host only
	# after it has been globally disabled with "a2disconf".
	#Include conf-available/serve-cgi-bin.conf

	<IfModule mod_rewrite.c>
		RewriteEngine on

    # to prevent direct logins
    #RewriteCond %{QUERY_STRING} direct
    #RewriteRule ^login$ - [R=404]

    # well-known
		RewriteRule ^/\.well-known/host-meta /public.php?service=host-meta [QSA,L]
		RewriteRule ^/\.well-known/host-meta\.json /public.php?service=host-meta-json [QSA,L]
		RewriteRule ^/\.well-known/carddav /remote.php/dav/ [R=301,L]
		RewriteRule ^/\.well-known/caldav /remote.php/dav/ [R=301,L]
		RewriteRule ^\.well-known/nodeinfo /index.php/.well-known/nodeinfo [R=301,L]
		RewriteRule ^\.well-known/webfinger /index.php/.well-known/webfinger [R=301,L]
	</IfModule>

	# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
	# error, crit, alert, emerg.
	# It is also possible to configure the loglevel for particular
	# modules, e.g.
	#LogLevel info ssl:warn

	ErrorLog ${APACHE_LOG_DIR}/error.log
	CustomLog ${APACHE_LOG_DIR}/access.log combined

	ProxyPass /push/ws ws://127.0.0.1:7867/ws
	ProxyPass /push/ http://127.0.0.1:7867/
	ProxyPassReverse /push/ http://127.0.0.1:7867/

	# For most configuration files from conf-available/, which are
	# enabled or disabled at a global level, it is possible to
	# include a line for only one particular virtual host. For example the
	# following line enables the CGI configuration for this host only
	# after it has been globally disabled with "a2disconf".
	#Include conf-available/serve-cgi-bin.conf

	Include /etc/letsencrypt/options-ssl-apache.conf
	SSLCertificateFile /etc/letsencrypt/live/<redacted>/fullchain.pem
	SSLCertificateKeyFile /etc/letsencrypt/live/<redacted>/privkey.pem
</VirtualHost>
</IfModule>

```

---

<div class="post-metadata">

**Author:** ![processor](https://help.nextcloud.com/letter_avatar/processor/32/5_5575768a8748004e209b776fc1b2916d.png) [@processor](https://help.nextcloud.com/u/processor)\
**Post date:** [June 17, 2024, 8:47am UTC](https://help.nextcloud.com/t/x-robots-tag-http-header-not-configured-with-noindex-nofollow-since-nc-26-0-0/158300/26 "2024-06-17T08:47:44Z")

</div>

Hi,

I’m in exactly same case :

- Server Ubuntu 20.04 (updated)
- PHP 8.2.20
- Apache 2.4.41

http headers give this log :

- **HTTP/1.1 301 Moved Permanently**
- Date: Mon, 17 Jun 2024 08:25:26 GMT
- Server: Apache/2.4.41 (Ubuntu)
- Location: [https://myserver.com/nextcloud/](https://myserver.com/nextcloud/)
- Content-Length: 312
- Connection: close
- Content-Type: text/html; charset=iso-8859-1
- **HTTP/1.1 200 OK**
- Date: Mon, 17 Jun 2024 08:25:27 GMT
- Server: Apache/2.4.41 (Ubuntu)
- Last-Modified: Sun, 16 Jun 2024 18:13:00 GMT
- ETag: “9c-61b05cc8b06c2”
- Accept-Ranges: bytes
- Content-Length: 156
- Vary: Accept-Encoding
- X-Frame-Options: sameorigin
- Connection: close
- Content-Type: text/html

Apache Config :

```auto
<VirtualHost *:80>
        ServerName myserver.com
        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/html
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        <Directory /var/www/html>
                Options -Indexes
        </Directory>
        RewriteEngine on
        RewriteCond %{SERVER_NAME} =myserver.com
        RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
        <Directory /var/www/html/nextcloud/>
                Require all granted
                AllowOverride All
                Options FollowSymLinks MultiViews
                <IfModule mod_dav.c>
                        Dav off
                </IfModule>
        </Directory>
</VirtualHost>

```

**Loaded modules :**

core\_module (static)  
so\_module (static)  
watchdog\_module (static)  
http\_module (static)  
log\_config\_module (static)  
logio\_module (static)  
version\_module (static)  
unixd\_module (static)  
access\_compat\_module (shared)  
alias\_module (shared)  
auth\_basic\_module (shared)  
authn\_core\_module (shared)  
authn\_file\_module (shared)  
authz\_core\_module (shared)  
authz\_host\_module (shared)  
authz\_user\_module (shared)  
autoindex\_module (shared)  
deflate\_module (shared)  
dir\_module (shared)  
_**env\_module (shared)**_  
filter\_module (shared)  
_**headers\_module (shared)**_  
mime\_module (shared)  
mpm\_prefork\_module (shared)  
negotiation\_module (shared)  
php\_module (shared)  
reqtimeout\_module (shared)  
_**rewrite\_module (shared)**_  
_**setenvif\_module (shared)**_  
socache\_shmcb\_module (shared)  
ssl\_module (shared)  
status\_module (shared)

**.htaccess in /var/www/html/nextcloud :**

```auto
<IfModule mod_headers.c>
  <IfModule mod_setenvif.c>
    <IfModule mod_fcgid.c>
       SetEnvIfNoCase ^Authorization$ "(.+)" XAUTHORIZATION=$1
       RequestHeader set XAuthorization %{XAUTHORIZATION}e env=XAUTHORIZATION
    </IfModule>
    <IfModule mod_proxy_fcgi.c>
       SetEnvIfNoCase Authorization "(.+)" HTTP_AUTHORIZATION=$1
    </IfModule>
    <IfModule mod_lsapi.c>
      SetEnvIfNoCase ^Authorization$ "(.+)" XAUTHORIZATION=$1
      RequestHeader set XAuthorization %{XAUTHORIZATION}e env=XAUTHORIZATION
    </IfModule>
  </IfModule>

  <IfModule mod_env.c>
    # Add security and privacy related headers

    # Avoid doubled headers by unsetting headers in "onsuccess" table,
    # then add headers to "always" table: https://github.com/nextcloud/server/pull/19002
    Header onsuccess unset Referrer-Policy
    Header always set Referrer-Policy "no-referrer"

    Header onsuccess unset X-Content-Type-Options
    Header always set X-Content-Type-Options "nosniff"

    Header onsuccess unset X-Frame-Options
    Header always set X-Frame-Options "SAMEORIGIN"

    Header onsuccess unset X-Permitted-Cross-Domain-Policies
    Header always set X-Permitted-Cross-Domain-Policies "none"

    Header onsuccess unset X-Robots-Tag
    Header always set X-Robots-Tag "noindex, nofollow"

    Header onsuccess unset X-XSS-Protection
    Header always set X-XSS-Protection "1; mode=block"

    SetEnv modHeadersAvailable true
  </IfModule>

  # Add cache control for static resources
  <FilesMatch "\.(css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite)$">
    <If "%{QUERY_STRING} =~ /(^|&)v=/">
      Header set Cache-Control "max-age=15778463, immutable"
    </If>
    <Else>
      Header set Cache-Control "max-age=15778463"
    </Else>
  </FilesMatch>

  # Let browsers cache WOFF files for a week
  <FilesMatch "\.woff2?$">
    Header set Cache-Control "max-age=604800"
  </FilesMatch>
</IfModule>

<IfModule mod_php.c>
  php_value mbstring.func_overload 0
  php_value default_charset 'UTF-8'
  php_value output_buffering 0
  <IfModule mod_env.c>
    SetEnv htaccessWorking true
  </IfModule>
</IfModule>

<IfModule mod_mime.c>
  AddType image/svg+xml svg svgz
  AddType application/wasm wasm
  AddEncoding gzip svgz
  # Serve ESM javascript files (.mjs) with correct mime type
  AddType text/javascript js mjs
</IfModule>

<IfModule mod_dir.c>
  DirectoryIndex index.php index.html
</IfModule>

<IfModule pagespeed_module>
  ModPagespeed Off
</IfModule>

<IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteCond %{HTTP_USER_AGENT} DavClnt
  RewriteRule ^$ /remote.php/webdav/ [L,R=302]
  RewriteRule .* - [env=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
  RewriteRule ^\.well-known/carddav /nextcloud/remote.php/dav/ [R=301,L]
  RewriteRule ^\.well-known/caldav /nextcloud/remote.php/dav/ [R=301,L]
  RewriteRule ^\.well-known/webfinger /nextcloud/index.php/.well-known/webfinger [R=301,L]
  RewriteRule ^\.well-known/nodeinfo /nextcloud/index.php/.well-known/nodeinfo [R=301,L]
  RewriteRule ^remote/(.*) remote.php [QSA,L]
  RewriteRule ^(?:build|tests|config|lib|3rdparty|templates)/.* - [R=404,L]
  RewriteRule ^\.well-known/(?!acme-challenge|pki-validation) /index.php [QSA,L]
  RewriteRule ^ocm-provider/?$ index.php [QSA,L]
  RewriteRule ^(?:\.(?!well-known)|autotest|occ|issue|indie|db_|console).* - [R=404,L]
</IfModule>

https://docs.nextcloud.com/server/latest/admin_manual/issues/general_troubleshooting.html#troubleshooting-webdav
<IfModule mod_setenvif.c>
  SetEnvIf Transfer-Encoding "chunked" proxy-sendcl=1
</IfModule>

AddDefaultCharset utf-8
Options -Indexes
#### DO NOT CHANGE ANYTHING ABOVE THIS LINE ####

ErrorDocument 403 /nextcloud/index.php/error/403
ErrorDocument 404 /nextcloud/index.php/error/404

```

And I’m still having this issue : Some headers are not set correctly on your instance …

Any help would be really appreciated

---

<div class="post-metadata">

**Author:** ![processor](https://help.nextcloud.com/letter_avatar/processor/32/5_5575768a8748004e209b776fc1b2916d.png) [@processor](https://help.nextcloud.com/u/processor)\
**Post date:** [June 17, 2024, 12:11pm UTC](https://help.nextcloud.com/t/x-robots-tag-http-header-not-configured-with-noindex-nofollow-since-nc-26-0-0/158300/27 "2024-06-17T12:11:12Z")

</div>

Ok, so I just found where the issue come from for my own case.  
I did not realized there was a separate file for SSL.  
Once I did realized this I addzd this in the SSL conf file and now headers are well handled :

```auto
        <Directory /var/www/html/nextcloud/>
                Require all granted
                AllowOverride All
                Options FollowSymLinks MultiViews
                <IfModule mod_dav.c>
                        Dav off
                </IfModule>
        </Directory>

```

---

<div class="post-metadata">

**Author:** ![battosai30](https://help.nextcloud.com/user_avatar/help.nextcloud.com/battosai30/32/63508_2.png) [@battosai30](https://help.nextcloud.com/u/battosai30)\
**Post date:** [July 17, 2024, 9:52am UTC](https://help.nextcloud.com/t/x-robots-tag-http-header-not-configured-with-noindex-nofollow-since-nc-26-0-0/158300/28 "2024-07-17T09:52:51Z")

</div>

Hi guys,

I found the problem : the code running test is base on doing GET on /heartbeat. But apparently, this route has a problem : [fix(settings): define a 'heartbeat' route, so SecurityHeaders can handle redirected root by smokris · Pull Request #45228 · nextcloud/server · GitHub](https://github.com/nextcloud/server/pull/45228)

Fix is scheduled so : wait or manually set URL in apps/settings/lib/SetupChecks/SecurityHeaders.php

Replace

```auto
	public function run(): SetupResult {
		$urls = [
			['get', $this->urlGenerator->linkToRoute('heartbeat'), [200]],
		];

```

by

```auto
	public function run(): SetupResult {
		$urls = [
			['get', '/heartbeat' , [200]],
		];

```

---

<div class="post-metadata">

**Author:** ![Darkk](https://help.nextcloud.com/letter_avatar/darkk/32/5_5575768a8748004e209b776fc1b2916d.png) [@Darkk](https://help.nextcloud.com/u/Darkk)\
**Post date:** [July 23, 2024, 3:43pm UTC](https://help.nextcloud.com/t/x-robots-tag-http-header-not-configured-with-noindex-nofollow-since-nc-26-0-0/158300/29 "2024-07-23T15:43:07Z")

</div>

> [@battosai30](#):
>
> Fix is scheduled so

Yep. The latest update of NC fixed this issue. I was going nuts trying to figure out if my instance is not setup correctly as I am using HAProxy on pfsense.

Now it’s all good. 😄

---

<div class="post-metadata">

**Author:** ![battosai30](https://help.nextcloud.com/user_avatar/help.nextcloud.com/battosai30/32/63508_2.png) [@battosai30](https://help.nextcloud.com/u/battosai30)\
**Post date:** [July 23, 2024, 8:39pm UTC](https://help.nextcloud.com/t/x-robots-tag-http-header-not-configured-with-noindex-nofollow-since-nc-26-0-0/158300/30 "2024-07-23T20:39:24Z")

</div>

Yep the fix works 😉

---

<div class="post-metadata">

**Author:** ![system](https://help.nextcloud.com/user_avatar/help.nextcloud.com/system/32/29333_2.png) [@system](https://help.nextcloud.com/u/system)\
**Post date:** [July 31, 2024, 8:39pm UTC](https://help.nextcloud.com/t/x-robots-tag-http-header-not-configured-with-noindex-nofollow-since-nc-26-0-0/158300/31 "2024-07-31T20:39:26Z")

</div>

This topic was automatically closed 8 days after the last reply. New replies are no longer allowed.

[Previous page](https://help.nextcloud.com/t/x-robots-tag-http-header-not-configured-with-noindex-nofollow-since-nc-26-0-0/158300.md?page=1)