Header unset ETag Header always set Content-Security-Policy “upgrade-insecure-requests” Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains Header always set X-Frame-Options "SAMEORIGIN" Header always set X-Content-Type-Options "nosniff" Header always set Referrer-Policy "same-origin" Header always set Permissions-Policy "geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);" Header always set X-XSS-Protection "1; mode=block"