Apache "Invalid command" in .htaccess: Enable the Missing Module

The full message in the Apache error log reads:

/var/www/html/.htaccess: Invalid command 'Header', perhaps misspelled or defined by a module not included in the server configuration

Visitors see a 500 Internal Server Error. The same text appears when apachectl configtest fails on a main config file, in which case Apache refuses to start or reload at all.

Apache is telling you it does not recognize the first word of a line. Either you typed it wrong, or the module that provides that directive is not loaded on this server. The quoted word is the key: look it up in the table below.

Which module provides the directive

The module names come from the Apache 2.4 documentation. Each directive's reference page lists its module at the top.

Fix 1: enable the module

On Debian and Ubuntu:

sudo a2enmod headers
sudo apachectl configtest
sudo systemctl restart apache2

Modules need a restart or reload to load; .htaccess alone cannot enable them. On RHEL, Rocky and AlmaLinux, modules are loaded by LoadModule lines in /etc/httpd/conf.modules.d/*.conf. Check what is active:

apachectl -M | sort

If the module is not in the list, uncomment or add its line, for example LoadModule headers_module modules/mod_headers.so, and restart. On shared hosting you cannot load modules yourself, so ask the host or remove the directive.

Fix 2: guard optional directives with IfModule

If the same .htaccess has to run on servers with different module sets (a plugin shipped to many hosts, a staging box, a local machine), wrap the rules:

<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
</IfModule>

With the guard, Apache skips the block silently when the module is absent instead of returning 500. The downside is that it also hides the fact that your headers are not being sent, so verify the result rather than trusting the guard. The सिक्योरिटी हेडर चेकर shows which headers actually reach the browser.

Fix 3: check for typos and invisible characters

If the module is loaded and the error persists, the directive text itself is wrong:

• Misspelling. RewriteEgine or ExpireActive produce this error. Compare against the documentation.
• Byte order mark or stray characters at the top of the file. An editor that saves with a BOM makes the first line unreadable, and the error quotes a garbled directive name. Re-save as UTF-8 without BOM.
• Smart quotes or non-breaking spaces copied from a web page. Find them with grep -nP '[^\x00-\x7F]' .htaccess.
• A directive that only exists in a newer Apache. Some features arrived in 2.4.x point releases. Check apachectl -v against the docs.
• Rules written for a different server. nginx config, IIS web.config and Apache 2.2 syntax do not mix. For 2.2-style access control, see AH01630 client denied by server configuration.

Fix 4: PHP settings under PHP-FPM or CGI

php_value upload_max_filesize 64M in .htaccess is a very common cause of this error on modern hosts, because the server runs PHP through FPM and mod_php is not installed. Move the setting to a .user.ini file in the same directory (supported by PHP-FPM and CGI/FastCGI) or to the pool's php.ini:

upload_max_filesize = 64M
post_max_size = 70M

Changes to .user.ini are cached for a short time controlled by user_ini.cache_ttl, which defaults to 300 seconds.

How to verify

1. Run sudo apachectl configtest and confirm Syntax OK.
2. Request the site and check the status with the HTTP स्टेटस चेकर. It should be 200 or the redirect you intended, not 500.
3. If the directive adds headers, confirm them with the HTTP Header Checker.
4. Tail the error log during the request to make sure no new "Invalid command" lines appear.

An अपटाइम मॉनिटर on a key page will alert you if a later deploy brings the 500 back.

अगले कदम

• Review the broader Apache .htaccess 500 error checklist.
• Troubleshoot rewrites in Apache mod_rewrite not working.
• Audit the headers you just enabled with the सिक्योरिटी हेडर चेकर.
• Read Fix 500 Internal Server Error.

सामान्य प्रश्न

Can I enable an Apache module from .htaccess?

No. Modules are loaded by the main server configuration (LoadModule or a2enmod) and need a reload or restart. .htaccess can only use directives from modules that are already loaded.

Does IfModule fix the error or just hide it?

It prevents the 500 by skipping the block when the module is missing. The feature inside the block will not work, so test the actual behavior.

Why did this start after a server upgrade or migration?

The new server probably has a different module set, or runs PHP through FPM instead of mod_php. Compare apachectl -M on the old and new machines.

Is the quoted word always the problem?

Yes, it is the first token Apache could not parse on that line. Fix that directive, and if another invalid command exists later in the file, Apache will report the next one.

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.