<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="X-Content-Type-Options" value="nosniff"/>
        <add name="X-XSS-Protection" value="0;" />
        <add name="X-Frame-Options" value="SAMEORIGIN;" />
        <add name="Strict-Transport-Security" value="max-age=63072000"/>
      </customHeaders>
    </httpProtocol>
  </system.webServer>
  <system.web>
    <httpRuntime enableVersionHeader="false" />
  </system.web>
</configuration>