Erweiterte Header in Drupal konfigurieren

<?php
// modules/custom/security_headers/src/EventSubscriber/AdvancedHeadersSubscriber.php

namespace Drupal\security_headers\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

class AdvancedHeadersSubscriber implements EventSubscriberInterface {

  public static function getSubscribedEvents() {
    return [KernelEvents::RESPONSE => ['onResponse', 0]];
  }

  public function onResponse(ResponseEvent $event) {
    $response = $event->getResponse();

    // Origin-Agent-Cluster: Prozess-Isolierung
    $response->headers->set('Origin-Agent-Cluster', '?1');

    // X-DNS-Prefetch-Control: DNS-Prefetching deaktivieren
    $response->headers->set('X-DNS-Prefetch-Control', 'off');

    // X-Download-Options: IE-spezifisch, "Open"-Button deaktivieren
    $response->headers->set('X-Download-Options', 'noopen');

    // X-Permitted-Cross-Domain-Policies: Flash/PDF blockieren
    $response->headers->set('X-Permitted-Cross-Domain-Policies',
      'none');
  }
}

# .htaccess — Erweiterte Header
<IfModule mod_headers.c>
  Header always set Origin-Agent-Cluster "?1"
  Header always set X-DNS-Prefetch-Control "off"
  Header always set X-Download-Options "noopen"
  Header always set X-Permitted-Cross-Domain-Policies "none"
</IfModule>