Security Headers in htaccess Don't Work
I'm assuming mod_headers is installed &amp; active? Otherwhise I can't say why the .htaccess rules are not applied (devOps is not my forte) but you could set them through the twig template. 

See here for the tag to use. Basically it comes down to something like this (untested): 

{% header 'X-Xss-Protection "1; mode=block"' %}
{% header 'X-Content-Type-Options "nosniff' %}
{% header 'X-Frame-Options ALLOWALL' %}
{% header 'Strict-Transport-Security "max-age=31536000"' %}
{% header 'Referrer-Policy no-referrer' %}


You can make those in a block and just include the block on all the relevant pages.