Try It Yourself - SyntaxStudy Editor

HTML / CSS / JS

# Apache .htaccess: security headers for a static or PHP site

<IfModule mod_headers.c>
    # MIME-sniffing protection
    Header always set X-Content-Type-Options "nosniff"

# Referrer policy — leaks minimal info to third parties
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Permissions policy — disable unneeded browser features
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=(), interest-cohort=()"

# Clickjacking
    Header always set X-Frame-Options "SAMEORIGIN"

# HSTS (only if your entire site is HTTPS)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# Remove server info headers
    Header always unset X-Powered-By
    Header always unset Server

# Cross-origin isolation headers (required for SharedArrayBuffer/high-res timers)
    Header always set Cross-Origin-Opener-Policy "same-origin"
    Header always set Cross-Origin-Embedder-Policy "require-corp"
    Header always set Cross-Origin-Resource-Policy "same-origin"
</IfModule>

# Serve static files with correct MIME types to make nosniff safe
AddType text/javascript .js
AddType text/css        .css
AddType image/svg+xml   .svg