InfinityFree version of the _headers file

.htaccess

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "https://nooshu.com"
    Header set Cache-Control "public, s-maxage=31536000, max-age=31536000"
    Header set Content-Security-Policy "base-uri 'self';child-src 'self';connect-src 'self';default-src 'none';img-src 'self' https://v1.indieweb-avatar.11ty.dev/;font-src 'self';form-action 'self' https://webmention.io https://submit-form.com/DmOc8anHq;frame-ancestors;frame-src 'self' https://player.vimeo.com/ https://www.slideshare.net/ https://www.youtube.com/ https://giscus.app/ https://www.google.com/;manifest-src 'self';media-src 'self';object-src 'none';script-src 'self' https://giscus.app/ https://www.google.com/ https://www.gstatic.com/;style-src 'self' 'unsafe-inline' https://giscus.app/;worker-src 'self';upgrade-insecure-requests"
    Header set Cross-Origin-Opener-Policy "same-origin"
    Header set Permissions-Policy "accelerometer=(),ambient-light-sensor=(),autoplay=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),navigation-override=(),payment=(),picture-in-picture=(),publickey-credentials-get=(),screen-wake-lock=(),sync-xhr=(),usb=(),web-share=(),xr-spatial-tracking=()"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set Cross-Origin-Resource-Policy "cross-origin"
    Header set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    Header set X-Content-Type-Options "nosniff"
    Header set X-DNS-Prefetch-Control "off"
    Header set X-Frame-Options "DENY"
    Header set X-Permitted-Cross-Domain-Policies "none"
    Header set Origin-Agent-Cluster "?1"
</IfModule>

# Force HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Handle 404 errors
ErrorDocument 404 /404.html

# Prevent directory listing
Options -Indexes

# Protect against common exploits
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK|DEBUG) [NC]
    RewriteRule ^(.*)$ - [F,L]
</IfModule>