What you think is what you get

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <httpProtocol>
            <customHeaders>
                <add name="Cache-Control" value="no-cache" />
                <!-- Try your URL in this Scen WebSite : https://securityheaders.com/  -->
                <!-- Good Solution ref https://blog.elmah.io/improving-security-in-asp-net-mvc-using-custom-headers/ -->
                <!-- 1. Enable HSTS (HTTP Strict Transport Security) -->
                <!-- ref : https://sdwh.dev/posts/2020/10/Cyber-Security-Web-Config-Configuration/#Contentt-Security-Policy-CSP  -->
                <!-- Hide Server Information -->
                <remove name="X-Powered-By" />
                <remove name="X-AspNetMvc-Version" />
                <!-- Referrer Policy -->
                <add name="Referrer-Policy" value="No-referrer-when-downgrade" />
                <!-- Anti-Clickjacking-->
                <add name="X-Frame-Options" value="DENY" />
                <!-- Anti-XSS for IE -->
                <add name="X-Xss-Protection" value="1; mode=block" />
                <!-- HSTS -->
                <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" />
                <!-- 1. Enable HSTS (HTTP Strict Transport Security) -->
                <!-- 2. Enable Http Header Content Security Policy(CSP) -->
                <!-- ref :https://stackoverflow.com/questions/35851651/content-security-policy-in-asp-net-webforms  -->
                <add name="Content-Security-Policy" value="default-src 'self'" />
                <!-- 2. Enable Http Header Content Security Policy(CSP) -->
                <!-- 3. Enable X-Content-Type-Options -->
                <!-- ref : https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff -->
                <remove name="X-Content-Type-Options"/>
                <add name="X-Content-Type-Options" value="nosniff"/>
                <!-- 3. Enable X-Content-Type-Options -->
                <!-- 4. Enable Permissions Policy -->
                <!-- ref https://blog.elmah.io/improving-security-in-asp-net-mvc-using-custom-headers/ -->
                <add name="Permissions-Policy" value="accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()" />
                <!-- 4. Enable Permissions Policy -->
            </customHeaders>
        </httpProtocol>
    </system.webServer>
</configuration>