ubuntuusers.de

<IfModule mod_headers.c>
Header set Strict-Transport-Security "max-age=31556926;"

Header set X-Content-Type-Options 
"nosniff"

Header set X-XSS-Protection 
"1; mode=block"

Header set Content-Security-Policy "default-src *.domain.de 'self' 'unsafe-inline';"

Header set Feature-Policy 
"accelerometer 'none'; ambient-light-sensor 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'self'; microphone 'none'; midi 'none'; usb 'none';"

Header set Referrer-Policy "origin-when-cross-origin"

Header set Expect-CT 
"max-age=0; report-uri=https://domain.de/reportOnly"

Header always edit Set-Cookie (.*) 
"$1; HttpOnly; Secure"

Header always set Public-Key-Pins "pin-sha256=\"base64+primary==\"; pin-sha256=\"base64+backup==\"; max-age=5184000; includeSubDomains"

Header append X-Frame-Options "SAMEORIGIN

Header unset X-Powered-By
</IfModule>

<IfModule mod_headers.c>
Header set Content-Security-Policy "default-src *.domain.de 'self' 'unsafe-inline';"
Header set Strict-Transport-Security "max-age=31556926;"
Header append X-Frame-Options "SAMEORIGIN" 
Header unset X-Powered-By 
Header always set X-Xss-Protection "1; mode=block"
Header always set X-Content-Type-Options "nosniff"
Header set Feature-Policy "accelerometer 'none'; ambient-light-sensor 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'self'; microphone 'none'; midi 'none'; usb 'none';"
Header always set Referrer-Policy "same-origin"
</IfModule>