.htaccess

# BEGIN Customs
php_flag expose_php off
<IfModule mod_headers.c>
    Header set Cross-Origin-Opener-Policy "same-origin"
    Header set Cross-Origin-Resource-Policy "same-origin"
    Header set Content-Security-Policy "default-src https: 'self' data:; connect-src 'self'"
    Header set Cross-Origin-Embedder-Policy "require-corp"
Header set X-Permitted-Cross-Domain-Policies "none"
    Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    Header set Referrer-Policy "no-referrer-when-downgrade"
    Header set X-Content-Type-Options "nosniff"
    Header set X-Download-Options "noopen"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-Permitted-Cross-Domain-Policies "none"
    Header set X-XSS-Protection "1; mode=block"
</IfModule>
# END Customs