---
title: "Adding Custom HTTP Headers to an IIS Installation"
slug: "adding-custom-http-headers-to-an-iis-installation"
updated: 2024-10-25T15:01:46Z
published: 2024-10-25T15:01:46Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.decisions.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Adding Custom HTTP Headers to an IIS Installation

## Overview

As a method of passing additional information through a server, **Administrators**may wish to add custom **HTTP****Headers**to their environment. Doing so allows Administrators to add additional security parameters to their environments.

Use CasePassing additional security requirements via **HTTP****Headers**into a Decisions environment can help prevent issues such a click-jacking or accidental script runs. 

In contrast to the method of adding tags to **Settings.xml** (for [Self Hosted](https://documentation.decisions.com/docs/adding-custom-http-headers-to-a-self-hosted-installation)****environments), custom HTTP Headers can be added to an IIS installation in one of two methods:

- Editing the **web.config** file
- Via **IIS Manager**

The following document demonstrates how to add custom HTTP Headers to IIS Decisions environments.

Additional ResourcesFor a list of common HTTP Headers and their functions, see [HTTP headers - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers).

---

## Example A: IIS Manager

To add custom HTTP Headers to an IIS Installation via IIS Manager:

1. From the **Local****File****System**, open **Internet Information Services (IIS) Manager** by locating it and selecting **Run as administrator**.![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/2021-11-12_16h06_56.png)
2. Navigate to the**IIS Installation** via the **Connections**Tree on the left. Then under the **IIS**category, select **HTTP Response Headers** and click **Open****Feature**.![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/2021-11-12_16h11_18.png)
3. From the HTTP Response Headers page, from the **Actions**menu on the right, select **Add****...**
4. From the **Add Custom HTTP Response Header** window, provide a **Name** and desired **Value**for one of the Headers below, then click OK. Repeat this process for each desired Header.Additional InformationProvide the following **Name**and Value combinations; see previous link to HTTP Headers doc for potential options for **Values**denoted as "[Desired Value]" below: 

| X-Frame-Options | SAMEORIGIN |
| --- | --- |
| X-XSS-Protection | [Desired Value] |
| X-Content-Type-Options | [Desired Value] |

![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/2021-11-12_16h27_18.png)
5. [Restart](https://documentation.decisions.com/v9/docs/restart-decisions-application)the Decisions environment.

---

## Example B: web.config

To add custom HTTP Headers in an IIS installation via web.config:

1. From the **Local****File****System**, navigate to **C:\Program Files\Decisions\Decisions Server**.
2. Open **web.config** in a **Text****Editor**. ![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/2021-11-12_16h39_43.png)
3. Before the closing**</configuration>**tag, add the following codeblock. Additional InformationFor parameters below where the **Value**is displayed as "VALUE", provide the desired Value. See the previously linked HTTP Headers document for more information on possible configurations. 

```powershell
<CustomHeaders> <CustomHeader> 
<Name>X-Frame-Options</Name> 
<Value>SAMEORIGIN</Value> 
</CustomHeader> 
<CustomHeader> 
<Name>X-XSS-Protection</Name> 
<Value>VALUE</Value> 
</CustomHeader> 
<CustomHeader> 
<Name>X-Content-Type-Options</Name> <Value>VALUE</Value> </CustomHeader> </CustomHeaders>
```

![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/2021-11-12_16h50_12.png)
4. Save and close the web.config file.
5. [Restart](https://documentation.decisions.com/v9/docs/restart-decisions-application)the Decisions environment.