Override Apache Configuration Without Editing System Files

Note#202

notes
Published

2026-03-18

Apache has no built-in priority system for config files. What makes this work is the IncludeOptional directive: it expands globs in alphabetical order. For directives like ServerTokens that take a single value, the last definition Apache reads wins.

On Debian, apache2.conf ships with IncludeOptional conf-enabled/*.conf. The same approach works on any distribution that uses IncludeOptional with a glob.

You can use this to override values from Debian’s default security.conf without touching it, so your changes survive package upgrades.

Create the Override File

install -m 640 -o root -g root /dev/null /etc/apache2/conf-available/zzz-security-override.conf

Write Your Overrides

cat /etc/apache2/conf-available/zzz-security-override.conf <<'EOF'
ServerSignature Off
ServerTokens Prod

<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set Content-Security-Policy "frame-ancestors 'self';"
</IfModule>
EOF

Enable and Reload

a2enconf zzz-security-override
apache2ctl -t
systemctl reload apache2

The zzz- prefix guarantees the file loads after security.conf. Even if a package update resets security.conf to Debian’s default ServerTokens OS, your override still wins.

Verify

Force a conflict by temporarily setting ServerSignature On and ServerTokens OS in security.conf, then reload Apache and check:

curl -I https://example.com/

The response should still show Server: Apache (no version), proving that zzz-security-override.conf takes precedence.