Web.config

<?xml version="1.0" encoding="utf-8"?>

<configuration>

	<system.web>
		<compilation debug="true" targetFramework="4.7"/>
		<httpRuntime targetFramework="4.7" enableVersionHeader="false" />
	</system.web>
	<system.webServer>
		<security>
			<requestFiltering removeServerHeader="true" />
		</security>
		<httpProtocol>
			<customHeaders>
				<add name="X-Content-Type-Options" value="NOSNIFF" />
				<add name="X-Frame-Options" value="DENY" />
				<add name="X-Permitted-Cross-Domain-Policies" value="master-only"/>
				<add name="X-XSS-Protection" value="1; mode=block"/>
				<remove name="X-Powered-By"/>
			</customHeaders>
		</httpProtocol>
		<rewrite>
			<rules>
				<rule name="ToHTTPS">
					<match url="(.*)"/>
					<conditions>
						<add input="{HTTPS}" pattern="Off"/>
						<add input="{REQUEST_METHOD}" pattern="^get$|^head$" />
					</conditions>
					<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent"/>
				</rule>
			</rules>
		</rewrite>
	</system.webServer>
	<system.serviceModel>
		<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
		<behaviors>
			<serviceBehaviors>
				<behavior name="ajaxService">
					<serviceMetadata httpGetEnabled="true" />
					<serviceDebug includeExceptionDetailInFaults="false"/>
				</behavior>
			</serviceBehaviors>
			<endpointBehaviors>
				<behavior name="ajaxEndpoint">
					<webHttp automaticFormatSelectionEnabled="true" defaultBodyStyle="Wrapped" defaultOutgoingResponseFormat="Json" />
				</behavior>
			</endpointBehaviors>
		</behaviors>
		<bindings>
			<webHttpBinding>
				<binding name="ajaxBinding">
					<security mode="Transport" />
				</binding>
			</webHttpBinding>
		</bindings>
		<services>
			<service name="ContentService" behaviorConfiguration="ajaxService">
				<endpoint contract="IContentService" binding="webHttpBinding" bindingConfiguration="ajaxBinding" behaviorConfiguration="ajaxEndpoint" />
			</service>
		</services>
	</system.serviceModel>

</configuration>