.htaccess

#copy to .htaccess file in root directory or create that file and copy this gits content to it
#you need to modify this for your self, specially the Content-Security-Policy part.

#Secure Header
<IfModule mod_headers.c>
  Header always set X-Frame-Options DENY
  Header always set X-Xss-Protection "1; mode=block"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Content-Security-Policy "script-src 'self'; object-src 'self'" 
  Header always set Referrer-Policy "no-referrer"
  Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains;"
  Header always set Feature-Policy "accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'"
</IfModule>


#https://www.askapache.com/htaccess/http-https-rewriterule-redirect/
#https redirection
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>