add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-UA-Compatible "IE=edge,chrome=1";
add_header Access-Control-Allow-Origin "{DOMAIN}";
add_header Cache-Control "max-age=31536000, immutable, public";
add_header Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload";
add_header Vary "Accept-Encoding";
add_header Referrer-Policy "no-referrer";

 Content-Security-Policy:
add_header Content-Security-Policy "Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline' https://storage.googleapis.com/ https://cdn.polyfill.io/; style-src 'self' 'unsafe-inline'; img-src 'self' https:; font-src 'self' https:; media-src 'self' https:; manifest-src 'self'; worker-src 'self' ; connect-src 'self' https:; object-src 'none'; frame-src 'self' https:; child-src 'self' https:; frame-ancestors 'none'; form-action 'none'; block-all-mixed-content; base-uri 'none';";