Enable Security HTTP Headers

We want Enable Security HTTP Headers. Does correct location is "Pre Main Include" or "Pre VirtualHost Include" section in "WHM >> Home >> Service Configuration >> Apache Configuration" ? Does this correct rules for Apache Configuration? # Enable Support Forward Secrecy SSLHonorCipherOrder On SSLProtocol all -SSLv2 -SSLv3 # Security header Enable HSTS Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS # Turn on IE8-IE9 XSS prevention tools X-XSS Header always set X-XSS-Protection "1; mode=block" # Referrer-Policy Header always set Referrer-Policy "no-referrer-when-downgrade" # X-Permitted-Cross-Domain-Policies Header always set X-Permitted-Cross-Domain-Policies "none"