Content Security Policy

return [
    'bnomei.securityheaders.headers' => [
        'X-Frame-Options'        => 'SAMEORIGIN',
        'X-XSS-Protection'       => '1; mode=block',
        'X-Content-Type-Options' => 'nosniff',
        ...
    ]
];