Adding securityheaders

Hello,

 

I have a situation where there is many websites behind one virtual server and I would need to enable securityheaders.io recommended headers to responses.

 

Is there any ways to apply header only to one host which is behind the vip. HSTS would propably break something if applied to the VIP from etc. http profile?

 

And other question is about doing this in the webserver? Is there any reason those headers can't be added in IIS if f5 is doing ssl offloading or briding. Both offloading and bridging are used in same vip through policies.

 

Any help is much appreciated!

 

BR

 

Teemu