By adding additional headers to your HTTP responses, you can help the browsers to protect the users as well as your site.

In regular asp.net you add the HTTP headers to the config file like this:

But if you are working with asp.net core you instead configure the HTTP request pipeline by adding code to the Configure function in the Startup.cs file:

You could also use a NuGet packages for it like NWebsec.AspNetCore.Middleware making it harder to misspell anything. Also every header becomes a one-liner instead:

And as a last option you could configure your webhost to deliver the http header as well, just search how for your choice of server.