From 2a469d3079ed29ecb4b226361f570f87db74f1ec Mon Sep 17 00:00:00 2001
From: Aaron Feledy <aaron@arrow.one>
Date: Sat, 7 Mar 2026 18:08:41 -0600
Subject: [PATCH 1/2] test: add mod_headers and mod_expires verification tests

Adds .htaccess to 8.4 example that sets a custom header via mod_headers
and enables mod_expires. Both tests expected to fail since the php-apache
startup command only runs 'a2enmod rewrite'.

Refs: lando/lando#976, #243
---
 examples/8.4/.htaccess | 8 ++++++++
 examples/8.4/README.md | 6 ++++++
 2 files changed, 14 insertions(+)
 create mode 100644 examples/8.4/.htaccess

diff --git a/examples/8.4/.htaccess b/examples/8.4/.htaccess
new file mode 100644
index 00000000..a26e0808
--- /dev/null
+++ b/examples/8.4/.htaccess
@@ -0,0 +1,8 @@
+<IfModule mod_headers.c>
+  Header set X-Lando-Test "blazes"
+</IfModule>
+
+<IfModule mod_expires.c>
+  ExpiresActive On
+  ExpiresDefault "access plus 1 hour"
+</IfModule>
diff --git a/examples/8.4/README.md b/examples/8.4/README.md
index adcc5350..cbe81b00 100644
--- a/examples/8.4/README.md
+++ b/examples/8.4/README.md
@@ -49,6 +49,12 @@ lando exec defaults -- composer --version --no-ansi | tee >(cat 1>&2) | grep -q
 lando php -i | grep memory_limit | grep -e "-1"
 lando exec defaults -- php -i | grep "memory_limit" | grep -e "-1"
 
+# Should have mod_headers enabled and working
+lando exec defaults -- curl -sI http://localhost | grep -i "X-Lando-Test: blazes"
+
+# Should have mod_expires enabled and working
+lando exec defaults -- curl -sI http://localhost | grep -i "Expires:"
+
 # Should not enable xdebug by default
 lando exec defaults -- php -m | grep xdebug || echo $? | grep 1
 

From 0c5e734996e89f3ab59f916060ea40c3472674e0 Mon Sep 17 00:00:00 2001
From: Aaron Feledy <aaron@arrow.one>
Date: Sat, 7 Mar 2026 19:11:00 -0600
Subject: [PATCH 2/2] fix: enable mod_headers and mod_expires Apache modules by
 default

The php-apache startup command only enabled mod_rewrite. This meant
mod_headers and mod_expires were available in the Debian image but
never activated, causing silent failures for .htaccess directives
that depend on them (CORS headers, caching, security headers).

This affects every recipe using via: apache (Drupal, WordPress,
Laravel, Backdrop, etc).

Closes #243
Refs: lando/lando#976
---
 CHANGELOG.md    | 2 ++
 builders/php.js | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index eb52f335..61904d6c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,7 @@
 ## {{ UNRELEASED_VERSION }} - [{{ UNRELEASED_DATE }}]({{ UNRELEASED_LINK }})
 
+* Enabled `mod_headers` and `mod_expires` Apache modules by default [#243](https://github.com/lando/php/issues/243)
+
 ## v1.11.2 - [February 25, 2026](https://github.com/lando/php/releases/tag/v1.11.2)
 
 * Fixed composer install crash caused by legacy prestissimo removal running as wrong user
diff --git a/builders/php.js b/builders/php.js
index 8a63dfce..6fc5b787 100644
--- a/builders/php.js
+++ b/builders/php.js
@@ -170,7 +170,7 @@ module.exports = {
       '/helpers',
     ],
     confSrc: path.resolve(__dirname, '..', 'config'),
-    command: ['sh -c \'a2enmod rewrite && apache2-foreground\''],
+    command: ['sh -c \'a2enmod rewrite headers expires && apache2-foreground\''],
     composer_version: true,
     phpServer: 'apache',
     defaultFiles: {