.htaccess

<IfModule mod_headers.c>
	Header always append X-Frame-Options SAMEORIGIN
	Header set X-Content-Type-Options nosniff
	Header always set Referrer-Policy "same-origin"
	Header set Permissions-Policy "geolocation=(), autoplay=(), camera=(), microphone=()" 
</IfModule>

RewriteEngine On
RewriteRule "\.(css|js|eot|ttf|woff|woff2|svg|ico|png)$" - [L]
RewriteRule "^simplesaml/" - [L]