In System Tools > Settings > Security there are 2 header related options:
- Use CTO and STS headers- X-Content-Type-Options: nosniff
- Strict-Transport-Security: max-age=$HSTSSeconds; includeSubDomains- $HSTSSeconds is set in noodle.properties (6 months default)
- Only set if HTTPS is in use
 
 
- Use RT, CSP, FO, XSSP headers- Report-To: ...1 day... /CSP.po- If Chrome or Edge of supporting versions
 
- Content-Security-Policy: $CSP- $CSP varies depending on the page served
 
- X-Frame-Options: SAMEORIGIN
- Referrer-Policy: strict-origin-when-cross-origin
- X-XSS-Protection: 1
 
- Report-To: ...1 day... /CSP.po