Apache sets headers with mod_headers. Here is a copy-paste config for HSTS, X-Frame-Options, nosniff and more — and why you want Header always set rather than Header set.