代码语言：javascript复制
<?xml version="1.0" encoding="UTF-8"?><configuration>
<system.webServer>
<httpProtocol>
<customHeaders>
<!--检测到目标X-Content-Type-Options响应头缺失-->
<add name="X-Content-Type-Options" value="nosniff" />
<!--检测到目标X-XSS-Protection响应头缺失-->
<add name="X-XSS-Protection" value="1" />
<!--检测到目标Content-Security-Policy响应头缺失-->
<!-- <add name="Content-Security-Policy" value="default-src 'self'" /> -->
<!--检测到目标Strict-Transport-Security响应头缺失-->
<add name="Strict-Transport-Security" value="max-age=31536000" />
<!--检测到目标Referrer-Policy响应头缺失-->
<add name="Referrer-Policy" value="origin-when-cross-origin" />
<!--检测到目标X-Permitted-Cross-Domain-Policies响应头缺失-->
<add name="X-Permitted-Cross-Domain-Policies" value="master-only" />
<!--检测到目标X-Download-Options响应头缺失-->
<add name="X-Download-Options" value="noopen" />
<!--点击劫持：X-Frame-Options未配置-->
<add name="X-Frame-Options" value="deny" />
</customHeaders>
</httpProtocol>
</system.webServer></configuration>设置完后IIS HTTP响应头设置界面显示如下
