SSLProtocol -all +TLSv1.1 +TLSv1.2

/etc/apache2/conf-available/security.conf

a2dismod deflate

SSLCompression Off

Header always set X-Content-Type-Options: "nosniff"

Header always set X-Frame-Options: "sameorigin"

Header always set X-XSS-Protection: 1

Header always set Content-Security-Policy: "default-src 'none'; script-src 'none'; style-src 'self'; img-src 'self'"

Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"

SSLCipherSuite ECDH+AESGCM256:DH+AESGCM256:ECDH+AES256:DH+AES256:ECDH+AES256:DH+AES256:RSA+AESGCM256:RSA+AES256:!aNULL:!MD5:!DSS:!eNULL:!ADH:!EXP:!LOW:!PSK:!SRP:!RC4