В конце я настроил web.config следующим образом, причина, по которой я делаю это напрямую через web.config, заключается в том, что у клиента нет доступа к панели управления IIS, и хост-компания не хочет его предоставлять..
Вот код, который я в конце концов придумал:
<!-- General Optimisation-->
<directoryBrowse enabled="false"/>
<!-- Security Headers -->
<httpProtocol>
<customHeaders>
<add name="Security-By" value="Sandhills Studio"/>
<add name="Content-Security-Policy" value="img-src 'self' https: data: blob:; font-src 'self' https: data:;"/>
<add name="X-Frame-Options" value="SAMEORIGIN"/>
<add name="X-XSS-Protection" value="1; mode=block"/>
<add name="Referrer-Policy" value="no-referrer-when-downgrade"/>
<add name="Expect-CT" value="max-age=86400,enforce"/>
<add name="Feature-Policy" value="fullscreen *;camera 'none';microphone 'none'"/>
<add name="X-Content-Type-Options" value="nosniff"/>
<add name="Strict-Transport-Security" value="max-age=15552000; includeSubDomains; preload"/>
<!--Remove Headers-->
<remove name="X-Powered-By"/>
<remove name="X-Powered-By-Plesk"/>
<remove name="Pragma"/>
<remove name="ETag"/>
</customHeaders>
</httpProtocol>
<!-- GZip static file content -->
<httpCompression directory="%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files" minFileSizeForComp="512">
<scheme name="gzip" dll="%Windir%\system32\inetsrv\gzip.dll" staticCompressionLevel="10"/>
<dynamicTypes>
<add mimeType="text/*" enabled="true"/>
<add mimeType="message/*" enabled="true"/>
<add mimeType="application/javascript" enabled="true"/>
<add mimeType="application/json" enabled="true"/>
<add mimeType="image/svg+xml" enabled="true"/>
<add mimeType="application/font-woff" enabled="true"/>
<add mimeType="application/x-font-ttf" enabled="true"/>
<add mimeType="application/octet-stream" enabled="true"/>
<add mimeType="*/*" enabled="false"/>
</dynamicTypes>
<staticTypes>
<add mimeType="text/*" enabled="true"/>
<add mimeType="message/*" enabled="true"/>
<add mimeType="application/atom+xml" enabled="true"/>
<add mimeType="application/javascript" enabled="true"/>
<add mimeType="application/json" enabled="true"/>
<add mimeType="application/ld+json" enabled="true"/>
<add mimeType="application/manifest+json" enabled="true"/>
<add mimeType="application/rdf+xml" enabled="true"/>
<add mimeType="application/rss+xml" enabled="true"/>
<add mimeType="application/schema+json" enabled="true"/>
<add mimeType="application/vnd.geo+json" enabled="true"/>
<add mimeType="application/vnd.ms-fontobject" enabled="true"/>
<add mimeType="application/x-font-ttf" enabled="true"/>
<add mimeType="application/x-javascript" enabled="true"/>
<add mimeType="application/x-web-app-manifest+json" enabled="true"/>
<add mimeType="application/xhtml+xml" enabled="true"/>
<add mimeType="application/xaml+xml" enabled="true"/>
<add mimeType="application/xml" enabled="true"/>
<add mimeType="application/font-woff" enabled="true"/>
<add mimeType="application/x-font-ttf" enabled="true"/>
<add mimeType="application/octet-stream" enabled="true"/>
<add mimeType="font/eot" enabled="true"/>
<add mimeType="font/opentype" enabled="true"/>
<add mimeType="image/bmp" enabled="true"/>
<add mimeType="image/svg+xml" enabled="true"/>
<add mimeType="image/vnd.microsoft.icon" enabled="true"/>
<add mimeType="image/x-icon" enabled="true"/>
<add mimeType="*/*" enabled="false"/>
</staticTypes>
</httpCompression>
<urlCompression doStaticCompression="true" doDynamicCompression="true"/>
<!-- Clinet Cache Control -->
<staticContent>
<!-- Set expire headers to 30 days for static content-->
<clientCache cacheControlMode="UseMaxAge" cacheControlMaxAge="30.00:00:00" setEtag="false"/>
<!-- use utf-8 encoding for anything served text/plain or text/html -->
<remove fileExtension=".air"/>
<mimeMap fileExtension=".air" mimeType="application/vnd.adobe.air-application-installer-package+zip"/>
<remove fileExtension=".css"/>
<mimeMap fileExtension=".css" mimeType="text/css"/>
<remove fileExtension=".js"/>
<mimeMap fileExtension=".js" mimeType="text/javascript"/>
<remove fileExtension=".json"/>
<mimeMap fileExtension=".json" mimeType="application/json"/>
<remove fileExtension=".rss"/>
<mimeMap fileExtension=".rss" mimeType="application/rss+xml; charset=UTF-8"/>
<remove fileExtension=".html"/>
<mimeMap fileExtension=".html" mimeType="text/html; charset=UTF-8"/>
<remove fileExtension=".xml"/>
<mimeMap fileExtension=".xml" mimeType="application/xml; charset=UTF-8"/>
<!-- HTML5 Audio/Video mime types-->
<remove fileExtension=".mp3"/>
<mimeMap fileExtension=".mp3" mimeType="audio/mpeg"/>
<remove fileExtension=".mp4"/>
<mimeMap fileExtension=".mp4" mimeType="video/mp4"/>
<remove fileExtension=".ogg"/>
<mimeMap fileExtension=".ogg" mimeType="audio/ogg"/>
<remove fileExtension=".ogv"/>
<mimeMap fileExtension=".ogv" mimeType="video/ogg"/>
<remove fileExtension=".webm"/>
<mimeMap fileExtension=".webm" mimeType="video/webm"/>
<!-- Proper svg serving. Required for svg webfonts on iPad -->
<remove fileExtension=".svg"/>
<mimeMap fileExtension=".svg" mimeType="image/svg+xml"/>
<remove fileExtension=".svgz"/>
<mimeMap fileExtension=".svgz" mimeType="image/svg+xml"/>
<!-- Remove default IIS mime type for .eot which is application/octet-stream -->
<remove fileExtension=".eot"/>
<mimeMap fileExtension=".eot" mimeType="application/vnd.ms-fontobject"/>
<remove fileExtension=".ttf"/>
<mimeMap fileExtension=".ttf" mimeType="application/x-font-ttf"/>
<remove fileExtension=".ttc"/>
<mimeMap fileExtension=".ttc" mimeType="application/x-font-ttf"/>
<remove fileExtension=".otf"/>
<mimeMap fileExtension=".otf" mimeType="font/opentype"/>
<remove fileExtension=".woff"/>
<mimeMap fileExtension=".woff" mimeType="application/x-font-woff"/>
<remove fileExtension=".woff2"/>
<mimeMap fileExtension=".woff2" mimeType="application/x-font-woff2"/>
<remove fileExtension=".less"/>
<mimeMap fileExtension=".less" mimeType="text/css"/>
<remove fileExtension=".crx"/>
<mimeMap fileExtension=".crx" mimeType="application/x-chrome-extension"/>
<remove fileExtension=".xpi"/>
<mimeMap fileExtension=".xpi" mimeType="application/x-xpinstall"/>
<remove fileExtension=".safariextz"/>
<mimeMap fileExtension=".safariextz" mimeType="application/octet-stream"/>
<!-- Flash Video mime types-->
<remove fileExtension=".flv"/>
<mimeMap fileExtension=".flv" mimeType="video/x-flv"/>
<remove fileExtension=".f4v"/>
<mimeMap fileExtension=".f4v" mimeType="video/mp4"/>
<!-- Assorted types -->
<remove fileExtension=".ico"/>
<mimeMap fileExtension=".ico" mimeType="image/x-icon"/>
<remove fileExtension=".webp"/>
<mimeMap fileExtension=".webp" mimeType="image/webp"/>
<remove fileExtension=".htc"/>
<mimeMap fileExtension=".htc" mimeType="text/x-component"/>
<remove fileExtension=".vcf"/>
<mimeMap fileExtension=".vcf" mimeType="text/x-vcard"/>
<remove fileExtension=".torrent"/>
<mimeMap fileExtension=".torrent" mimeType="application/x-bittorrent"/>
<remove fileExtension=".cur"/>
<mimeMap fileExtension=".cur" mimeType="image/x-icon"/>
<remove fileExtension=".webapp"/>
<mimeMap fileExtension=".webapp" mimeType="application/x-web-app-manifest+json; charset=UTF-8"/>
</staticContent>
К сожалению, SVG не GZipped, хотя в списке ниже, что это должно быть включено, как этоКажется, IIS по умолчанию не распознает этот тип пантомимы.
Если у кого-то есть предложения, не стесняйтесь, дайте мне знать!