Security Headers for .htaccess

APPACHE

# Security Headers
<IfModule mod_headers.c>
	Header set Developed-By "Sandhills Studio"
	Header set Content-Security-Policy "img-src 'self' https: data: blob:; font-src 'self' https: data:; base-uri 'self';"
	Header set X-Frame-Options "SAMEORIGIN"
	Header set X-XSS-Protection "1; mode=block"
	Header set Referrer-Policy "no-referrer-when-downgrade"
	Header set Expect-CT "max-age=86400,enforce"
	Header set Feature-Policy "fullscreen *;camera 'none';microphone 'none'"
	Header always edit Set-Cookie (.*) "$1;HttpOnly;Secure"
	Header always unset "X-Powered-By"
	Header set X-Content-Type-Options "nosniff"
	Header set Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
</IfModule>

#Block access to hidden files and directories
<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteCond %{REQUEST_URI} "!(^|/)\.well-known/([^./]+./?)+$" [NC]
	RewriteCond %{SCRIPT_FILENAME} -d [OR]
	RewriteCond %{SCRIPT_FILENAME} -f
	RewriteRule "(^|/)\." - [F]
</IfModule>

#Block access to files that can expose sensitive information.
<IfModule mod_authz_core.c>
	<FilesMatch "(^#.*#|\.(bak|conf|dist|fla|in[ci]|log|orig|psd|sh|sql|sw[op])|~)$">
		Require all denied
	</FilesMatch>
</IfModule>

ASP.NET
<httpProtocol>
		<customHeaders>
		<add name="Security-By" value="Zenmarket"/>
		<add name="Content-Security-Policy" value="img-src 'self' https: data: blob:; font-src 'self' https: data:;"/>
		<add name="X-Frame-Options" value="SAMEORIGIN"/>
		<add name="X-XSS-Protection" value="1; mode=block"/>
		<add name="Referrer-Policy" value="no-referrer-when-downgrade"/>
		<add name="Expect-CT" value="max-age=86400,enforce"/>
		<add name="Feature-Policy" value="fullscreen *;camera 'none';microphone 'none'"/>
		<add name="X-Content-Type-Options" value="nosniff"/>
		<add name="Strict-Transport-Security" value="max-age=15552000; includeSubDomains; preload"/>
		</customHeaders>
	</httpProtocol>