web.config

<system.webServer>
    <httpProtocol>
        <customHeaders>
			<remove name="X-Powered-By">
			<add name="X-Frame-Options" value="DENY" />
            <add name="X-Content-Type-Options" value="nosniff" />
			<add name="X-XSS-Protection" value="1; mode=block" />
			<add name="X-UA-Compatible" value="IE=edge,chrome=1" />
			<add name="Access-Control-Allow-Origin" value="{DOMAIN}" />
			<add name="Cache-Control" value="max-age=2592000, must-revalidate, public" />
			<add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains; preload" />
			<remove name="Vary" />
			<add name="Vary" value="Accept-Encoding" />
			<add name="Referrer-Policy" value="no-referrer" />

            <add name="Content-Security-Policy" value="default-src 'none'; script-src 'unsafe-inline' https: 'nonce-CHANGE' 'strict-dynamic'; style-src 'self'; img-src 'self' https:; font-src 'self' https:; media-src 'self' https:; manifest-src 'self'; worker-src 'self' https:; connect-src 'self' https:; object-src 'none'; frame-src 'self' https:; child-src 'self' https:; report-uri https://DOMAIN.report-uri.com/r/d/csp/enforce; frame-ancestors 'none'; form-action 'none'; block-all-mixed-content; base-uri 'none';" />
        </customHeaders>
    </httpProtocol>
</system.webServer>