Support

The Options +FollowSymLinks directive in the generated .htaccess is coming from the Follow symlinks setting in Admin Tools' .htaccess Maker. Some Apache configurations — particularly security-hardened ones like yours on Virtualmin — forbid .htaccess files from setting +FollowSymLinks, and Apache responds with a 500 error when it encounters that directive.

To fix this:

1. Go to Components → Admin Tools → .htaccess Maker.
2. Find the Follow symlinks option (it is labelled "may cause a blank page or 500 Internal Server Error" — that warning is precisely for your situation).
3. Change it to Default. This removes the Options +FollowSymLinks line from the generated .htaccess entirely.
4. Click Save & Create .htaccess in the toolbar.

Your server will continue to use whatever symlink-following behaviour is configured in the Apache virtual host or server config, which is exactly what you want. The security rules Admin Tools applies do not depend on symlink following, so this change has no negative effect on your site's protection.

The Header directives are generated by most of the security header settings in the .htaccess Maker — click-jacking protection, MIME type risks, reflected XSS protection, HSTS, referrer policy, no server signature, and more. Disabling them one by one is impractical and would strip out a significant portion of the security benefit.

This points to two distinct server-side issues on your Virtualmin/Apache setup:

1. Options directives are blocked — your Apache virtual host does not allow .htaccess files to use Options. Fix: add Options to the AllowOverride directive in your virtual host config.

2. Header directives are blocked — most likely mod_headers is not enabled in Apache. Fix:

sudo a2enmod headers
sudo systemctl restart apache2

Once mod_headers is enabled, Header directives in .htaccess will work. You may also need to ensure AllowOverride includes FileInfo in your virtual host block.

The combined AllowOverride line that covers everything Admin Tools needs is:

AllowOverride Options FileInfo AuthConfig Limit

After making both changes and restarting Apache, regenerate the .htaccess from the .htaccess Maker with your preferred security settings — everything should work correctly.

If for any reason you cannot enable mod_headers on this server, the only alternative is to disable all of the security header features in the .htaccess Maker individually, which would leave your site without HTTP security headers. In that case, you would need to configure those headers at the Apache virtual host level instead, which is actually a more robust approach (headers set at the vhost level cannot be stripped by a compromised .htaccess).