add security headers

docker/templates/vhost_app.conf

@@ -15,4 +15,16 @@
     Require all denied
   </Location>
 
+  # security headers
+
+  Header unset X-Powered-By
+
+  Header set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
+
+  Header set X-Frame-Options "SAMEORIGIN"
+  Header set X-Content-Type-Options "nosniff"
+  Header set X-XSS-Protection "1; mode=block"
+  Header set Feature-Policy "sync-xhr 'self'"
+  Header set Referrer-Policy "strict-origin-when-cross-origin"
+
 </VirtualHost>
\ No newline at end of file