How To Add CSP frame ancestors in WordPress Website? [closed]

SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X-]{4,13}$ HAVE_Accept-Encoding

The regex ^(Accept-EncodXng|X-cept-Encoding|X{15}|{15}|-{15})$ is invalid, hence the error you are getting. Specifically, the error is here:

^(Accept-EncodXng|X-cept-Encoding|X{15}|{15}|-{15})$
---------------------------------------^

{15} is a quantifier, but the preceding token | is not quantifiable, since this is itself a special meta character. There is something missing. But it’s not clear what this should be just by looking at the regex. However, it’s possible this rule is based on the findings of this PDF/slides from 2009 (regarding mangled Accept-Encoding headers) so would make the missing character a ~ (tilde) – but that list is far from exhaustive (and in most cases the Accept-Encoding header is stripped entirely, which this rule does not check for). For example:

^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$

Or you could just make the regex valid by removing that part of the alternation altogether. For example:

^(Accept-EncodXng|X-cept-Encoding|X{15}|-{15})$

Although this and the following RequestHeader directive are only to “fix a mangled” Accept-Encoding header, and in the majority of cases where this would apply, the Accept-Encoding header is stripped entirely (which this rule does not check for). It’s debatable whether this is required with today’s web.

Just by looking at this rule block it’s not clear whether the second SetEnvIfNoCase directive is required or not. (Although I assume you are compressing the response with Apache?)

Needless to say, this error has little to do with mod_headers. It just so happens that this directive is inside an <IfModule mod_headers.c> container.