A .htaccess file on the highest web server level, may contain this:

common htaccess statements

Also check our page about security headers.