ServerSignature Off
ServerTokens Prod
TraceEnable off
Header unset X-Powered-By
Header set X-Frame-Options SAMEORIGIN
Header set X-XSS-Protection 1;mode=block
Header set X-Content-Type-Options nosniff
Header always edit Set-Cookie (.*) "$1; HttpOnly; Secure"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header set Referrer-Policy "no-referrer"
Header set Content-Security-Policy "frame-ancestors 'self';