Header set Accept-Ranges none

Header set Cache-Control "private, max-age=600"

Header set Content-Security-Policy "default-src 'none'; style-src 'self'; script-src 'self'; img-src 'self'; child-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none';"

Header set Cross-Origin-Embedder-Policy "require-corp"

Header set Cross-Origin-Opener-Policy "same-origin"

Header set Cross-Origin-Resource-Policy "same-origin"

Header always set Expect-CT "max-age=31536000, enforce"

Header set Feature-Policy "autoplay 'none'; camera 'none'; geolocation 'none'; microphone 'none';"

Header set Permissions-Policy "accelerometer=(); camera=(); fullscreen=(); geolocation=(); gyroscope=(); interest-cohort=(); magnetometer=(); microphone=(); midi=(); notifications=(); payment=(); push=(); sync-xhr=(); unload=(); usb=(); xr=();"  

Header set Referrer-Policy "no-referrer"

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Header set X-Content-Type-Options "nosniff"

Header set X-DNS-Prefetch-Control "off"

Header set X-Download-Options "noopen"

Header set X-Frame-Options "DENY"

Header set X-Permitted-Cross-Domain-Policies "none"

Header set X-UA-Compatible "IE=Edge"

Header set X-XSS-Protection "1; mode=block"