Header set Accept-Ranges none
Header set Cache-Control "private, max-age=600"
Header set Content-Security-Policy "default-src 'none'; style-src 'self'; script-src 'self'; img-src 'self'; child-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none';"
Header set Cross-Origin-Embedder-Policy "require-corp"
Header set Cross-Origin-Opener-Policy "same-origin"
Header set Cross-Origin-Resource-Policy "same-origin"
Header always set Expect-CT "max-age=31536000, enforce"
Header set Feature-Policy "autoplay 'none'; camera 'none'; geolocation 'none'; microphone 'none';"
Header set Permissions-Policy "accelerometer=(); camera=(); fullscreen=(); geolocation=(); gyroscope=(); interest-cohort=(); magnetometer=(); microphone=(); midi=(); notifications=(); payment=(); push=(); sync-xhr=(); unload=(); usb=(); xr=();"  
Header set Referrer-Policy "no-referrer"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header set X-Content-Type-Options "nosniff"
Header set X-DNS-Prefetch-Control "off"
Header set X-Download-Options "noopen"
Header set X-Frame-Options "DENY"
Header set X-Permitted-Cross-Domain-Policies "none"
Header set X-UA-Compatible "IE=Edge"
Header set X-XSS-Protection "1; mode=block"