headers-more

Set and clear arbitrary request and response headers

dynamic moduleBSD-2-Clausesource

Overview

headers-more-nginx-module sets, replaces, and clears arbitrary request and response headers. Unlike the stock add_header directive, it can rewrite built-in headers such as Server and Content-Type, and it applies to every status code by default, including 4xx and 5xx errors.

Operators use it to hide the Server banner, strip internal headers before responses leave the proxy, and inject or scrub request headers before they reach an upstream. Header rules can be filtered by status code and content type, and cleared by wildcard pattern.

The module is written and maintained by Yichun Zhang (agentzh) of OpenResty Inc. and ships with OpenResty by default.

Key directives

more_set_headersSets or replaces output headers, with -s to match specific status codes and -t to match content types.
more_clear_headersRemoves output headers entirely, including built-ins like Server, and accepts wildcards such as X-Internal-*.
more_set_input_headersSets or replaces request headers before they reach upstreams and later processing phases.
more_clear_input_headersRemoves request headers, for example stripping a client-supplied X-Forwarded-For.
Works on error responsesHeader rules apply to 4xx and 5xx responses by default, where add_header needs the always flag.

Example

nginx.conf
load_module modules/ngx_http_headers_more_filter_module.so; server { listen 80; more_clear_headers 'Server' 'X-Powered-By'; more_set_headers 'X-Frame-Options: DENY'; location /api/ { more_set_headers -s '404 500' -t 'text/html' 'X-Error-Page: static'; more_set_input_headers 'X-Request-Source: edge'; proxy_pass http://backend; } }

Availability

Ships as a dynamic module in libnginx-mod-http-headers-more-filter, installed automatically with nginx-extras. The package drops a load_module config into /etc/nginx/modules-enabled/, so it loads on start.