I'm researching security headers and made some notes, and wanted to confirm I have it down right. Basically I am wanting to make sure I have the text right as well as implementing each via htaccess as opposed to a meta tag? Am I missing anything massive? I am  running a static website (html / css / javascript w/o a web-based cms like WordPress). Thoughts? Particularly etags and the last entry about leaked php version?

eTags
ETag: If-None-Match: "33a64df551425fcc55e4d42a148795d9f25f89d4"

Security Headers -
 
CSP: Frame-ancesetors
     Header always append X-Frame-Options SAMEORIGIN via htaccess
or
     Content-Security-Policy: frame-ancestors 'none';
     Content-Security-Policy: frame-ancestors 'self' https://www.example.org;

Security Headers – X-Content-Type: nosniff
     Header set X-Content-Type-Options nosniff via htaccess

Strict-Transport-Security HSTS 
     Strict-Transport-Security: max-age=63072000; includeSubDomains; preload 

CPS Content Security Policy
     Header set Content-Security-Policy “script-src 'none';” via htaccess (preferred)
or 
     Content-Security-Policy: script-src 'self'; img-src ‘self’; via htaccess (allows images and js) 
Or 
     <meta http-equiv="Content-Security-Policy" content="script-src 'none';"> 

Leaked PHP version
?
 

What security headers work with a non-wordpress website hosted with GoDaddy on Linux? I tried the below and got an error. Thoughts? 

#Security Headers Linux
<IfModule mod_headers.c>
Header set X-XSS-Protection "1; mode=block"
Header always append X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options nosniff
Header set Content-Security-Policy "default-src 'self'"
</IfModule>

Rob

Is the module installed on godaddy?