HTTP Headers Here are some basic HTTP headers you can use to secure a site in the Apache vhost conf file. You can add {'unsafe-inline' 'unsafe-eval'} and {*.yoursite.com} to each section of the Content-Security-Policy if necessary. Check your site's security compliance at the following link:https://securityheaders.com/?q=[www.yoursite.com]&follo…

httpHeaders.conf

Header always set Content-Security-Policy: "default-src 'self'; script-src 'self'; img-src 'self' data:; connect-src 'self'; style-src 'self'; font-src 'self'; frame-src 'self'"
Header set Cache-Control "private; max-age=31536000"
Header set Pragma "no-cache"
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "SAMEORIGIN"
Header set Referrer-Policy "no-referrer-when-downgrade"