public function onRespond(FilterResponseEvent $event) {

								$response = $event->getResponse();

								// ...

								// Prevent browsers from sniffing a response and picking a MIME type
								// different from the declared content-type, since that can lead to
								// XSS and other vulnerabilities.
								// https://www.owasp.org/index.php/List_of_useful_HTTP_headers
								$response->headers->set('X-Content-Type-Options', 'nosniff', FALSE);

								// ...
							}
						

							# Various header fixes.
							<IfModule mod_headers.c>
								# Disable content sniffing, since it's an attack vector.
								Header always set X-Content-Type-Options nosniff
								# Disable Proxy header, since it's an attack vector.
								RequestHeader unset Proxy
							</IfModule>
						

							public function onRespond(FilterResponseEvent $event) {

								$response = $event->getResponse();

								// ...

								$response->headers->set('X-Frame-Options', 'SAMEORIGIN', FALSE);

								// ...
							}
						

							services:
								my_module.response_listener:
									class: Drupal\my_module\EventSubscriber\ResponseSubscriber
									arguments: ['@config.factory']
									tags:
										- { name: event_subscriber }
						

							namespace Drupal\my_module\EventSubscriber;

							use Symfony\Component\EventDispatcher\EventSubscriberInterface;
							use Symfony\Component\HttpKernel\Event\FilterResponseEvent;

							class ResponseSubscriber implements EventSubscriberInterface {

								public static function getSubscribedEvents() {
									$events[KernelEvents::RESPONSE] = ['onKernelResponse'];
									return $events;
								}

								public function onKernelResponse(FilterResponseEvent $event) {
									if (!$event->isMasterRequest()) {
										return;
									}

									$response = $event->getResponse();

									$response->headers->set('HeaderName', 'header-value');
								}
							}
						

							SSLEngine On
							SSLCertificateFile    example.crt
							SSLCertificateKeyFile example.key

							# Set HSTS header for six months
							<IfModule mod_headers.c>
									Header always set Strict-Transport-Security "max-age=15552000"
							</IfModule>
						

							Content-Security-Policy:
								default-src 'self';
								script-src 'self' 'unsafe-inline' code.jquery.com www.google.com www.google-analytics.com;
								style-src 'self' 'unsafe-inline' netdna.bootstrapcdn.com www.google.com ajax.googleapis.com;
								img-src 'self' s3.amazonaws.com www.google-analytics.com stats.g.doubleclick.net;
								connect-src 'self' www.drupal.org www.google-analytics.com;
								report-uri https://gapple.report-uri.io/r/default/csp/enforce;
						

							Content-Security-Policy:
								default-src *;
								script-src * 'unsafe-inline';
								style-src * 'unsafe-inline';
								report-uri https://gapple.report-uri.io/r/default/csp/enforce;

							Content-Security-Policy-Report-Only:
								default-src 'self';
								report-uri https://gapple.report-uri.io/r/default/csp/reportOnly;
						

								Content-Security-Policy:
									default-src 'self';
									script-src assets.example.com;
									style-src assets.example.com;
									img-src assets.example.com files.example.com;
									connect-src 'self';
							

								testlib:
									version: "1.x"
									css:
										theme:
											https://example.com/css/testlib.css: {}
									js:
										http://example.com/js/testlib.js: {}