Security headers are HTTP response headers that characterize whether a set of security safeguards ought to be activated or deactivated on the internet browser.

The .htaccess could be configured by default with those options:

<IfModule mod_headers.c>
# Fix for https://httpoxy.org vulnerability
  RequestHeader unset Proxy

# X-XSS-Protection
  Header set X-XSS-Protection "1; mode=block"

# Permissions-Policy
  Header always set Permissions-Policy "geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);"

# Strict-Transport-Security
  Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
</IfModule>

Best Regards