How to configure Security Headers in Apache – Quick Sheet
Enable HSTS Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" Enable X-Frame-Options Header always append X-Frame-Options SAMEORIGIN Enable X-XSS-Protection Header set X-XSS-Protection "1; mode=block" Enable X-Content-Type-Options Header always set X-Content-Type-Options "nosniff" Enable Referrer-Policy Header always set Referrer-Policy "strict-origin" Enable Content Security Policy (CSP) Header always set Content-Security-Policy "default-src 'self'; font-src*;img-src * data:; script-src *; style-src *;" Enable Permissions-Policy Header always set Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()"
https://fleetfoundation.com/2024/02/25/how-to-configure-security-headers-in-apache-quick-sheet/
