Where to use {% header %}
This is something that is best done via server-side config. The reason is that when an image is requested, for instance, your Twig code that sets the header never gets run for that request.

You can see how it is done via Nginx here: Nginx-Craft

For Apache (don't use .htaccess pls) go here: html5 boilerplate apache