A .htaccess file on the highest web server level, may contain this:

conditional-redirect-in-htaccess.txt

As a matter of fact, security headers, except HSTS, are not read until web server level.
See example: https://securityheaders.com/?q=https%3A%2F%2Fhostingtool.nl%2F

Also check our page about security headers.