Security Headers

.htaccess

<IfModule mod_headers.c>
    Header always append X-Frame-Options SAMEORIGIN
    Header always set Strict-Transport-Security "max-age=10886400; includeSubDomains"
    Header set X-XSS-Protection "1; mode=block"
    Header set Content-Security-Policy default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';
    Header set X-Content-Type-Options nosniff
    Header set X-Permitted-Cross-Domain-Policies "none"
    Header set Referrer-Policy "no-referrer"
    Header set Feature-Policy "geolocation 'self'; vibrate 'none'"
</IfModule>