---
title: "Adding Custom HTTP Headers to an IIS Installation"
slug: "adding-custom-http-headers-to-an-iis-installation"
description: "Learn how administrators can add custom HTTP headers to pass information through a server and apply additional security parameters."
updated: 2026-04-27T20:46:33Z
published: 2026-04-28T14:12:51Z
canonical: "documentation.decisions.com/adding-custom-http-headers-to-an-iis-installation"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.decisions.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Adding Custom HTTP Headers to an IIS Installation

## Overview

As a method of passing additional information through a server, **Administrators** may wish to add custom **HTTP** **Headers** to their environment. Doing so allows Administrators to add additional security parameters to their environments.

Use CasePassing additional security requirements via **HTTP** **Headers** into a Decisions environment can help prevent issues such a click-jacking or accidental script runs. 

In contrast to the method of adding tags to **Settings.xml** (for [Self Hosted](https://documentation.decisions.com/version-10/docs/adding-custom-http-headers-to-a-self-hosted-installation) environments), custom HTTP Headers can be added to an IIS installation in one of two methods:

- Editing the **web.config** file
- Via **IIS Manager**

The following document demonstrates how to add custom HTTP Headers to IIS Decisions environments.

Additional ResourcesFor a list of common HTTP Headers and their functions, see [HTTP headers - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers).

---

## Example A: IIS Manager

To add custom HTTP Headers to an IIS Installation via IIS Manager:

1. From the **Local** **File** **System**, open **Internet Information Services (IIS) Manager** by locating it and selecting **Run as administrator**.![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/2021-11-12_16h06_56.png)
2. Navigate to the **IIS Installation** via the **Connections** Tree on the left. Then under the **IIS** category, select **HTTP Response Headers** and click **Open** **Feature**.![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/2021-11-12_16h11_18.png)
3. From the HTTP Response Headers page, from the **Actions** menu on the right, select **Add****...**
4. From the **Add Custom HTTP Response Header** window, provide a **Name** and desired **Value** for one of the Headers below, then click OK. Repeat this process for each desired Header.Additional InformationProvide the following **Name** and Value combinations; see previous link to HTTP Headers doc for potential options for **Values** denoted as "[Desired Value]" below: 

| X-Frame-Options | SAMEORIGIN |
| --- | --- |
| X-XSS-Protection | [Desired Value] |
| X-Content-Type-Options | [Desired Value] |

![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/2021-11-12_16h27_18.png)
5. [Restart](https://documentation.decisions.com/version-10/docs/restart-decisions-application) the Decisions environment.

---

## Example B: web.config

To add custom HTTP Headers in an IIS installation via web.config:

1. From the **Local** **File** **System**, navigate to **C:\Program Files\Decisions\Decisions Server**.
2. Open **web.config** in a **Text** **Editor**. ![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/2021-11-12_16h39_43.png)
3. Before the closing **</configuration>** tag, add the following codeblock. Additional InformationFor parameters below where the **Value** is displayed as "VALUE", provide the desired Value. See the previously linked HTTP Headers document for more information on possible configurations. 

```powershell
<CustomHeaders> <CustomHeader> 
<Name>X-Frame-Options</Name> 
<Value>SAMEORIGIN</Value> 
</CustomHeader> 
<CustomHeader> 
<Name>X-XSS-Protection</Name> 
<Value>VALUE</Value> 
</CustomHeader> 
<CustomHeader> 
<Name>X-Content-Type-Options</Name> <Value>VALUE</Value> </CustomHeader> </CustomHeaders>
```

![](https://cdn.document360.io/6ef8bcc1-6489-4486-9ad1-83acff7e5df0/Images/Documentation/2021-11-12_16h50_12.png)
4. Save and close the web.config file.
5. [Restart](https://documentation.decisions.com/version-10/docs/restart-decisions-application) the Decisions environment.