I have created an htaccess file for my multi-site Wordpress website, which contains the standard rewrite rules followed by a mod_headers section, with conditional FilesMatch directives.

The http headers all apply correctly to subdocuments of any Wordpress page (e.g. png, jpg, js, css etc), but never apply to the root document. Another pure html site on the same host does receive the headers correctly.

For example: https://www.somedomain.com/site.css returns:

    HTTP/2 200 OK
    content-type: text/css
    date: Mon, 30 Mar 2020 09:36:10 GMT
    server: Apache
    x-content-type-options: nosniff
    last-modified: Sun, 29 Mar 2020 12:55:43 GMT
    etag: "14546d-5a1fdda3e88c5-gzip"
    accept-ranges: bytes
    cache-control: must-revalidate, public, max-age=31536000
    expires: Sat, 20 Mar 2021 09:36:10 GMT
    vary: Accept-Encoding,User-Agent
    content-encoding: gzip

but https://www.somedomain.com/ only returns:

HTTP/1.1 200 Connection established
content-type: text/html; charset=UTF-8
date: Mon, 30 Mar 2020 09:36:09 GMT
server: Apache
x-powered-by: PHP/7.3.16
cache-control: no-cache
content-encoding: gzip

The htaccess code is below:

#BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]

#add a trailing slash to /wp-admin
    RewriteRule ^wp-admin$ wp-admin/ [R=301,L]

    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]
    RewriteRule ^(wp-(content|admin|includes).*) web/$1 [L]
    RewriteRule ^(.*\.php)$ web/$1 [L]
    RewriteRule . index.php [L]
</IfModule>
#END WordPress

#BEGIN Headers
<IfModule mod_headers.c>
#Remove server headers
    Header always unset X-Redirect-By
    Header always unset X-Powered-By
    Header always unset Location
#Set server headers
    Header always set X-Content-Type-Options nosniff
    Header append Vary "Accept-Encoding, User-Agent"
#Set Cache-Control
    <FilesMatch "\.(ico|jpe?g|png|gif|svg|webp|swf|css|mp4)$">
        Header set Cache-Control "must-revalidate, public, max-age=31536000"
    </FilesMatch>
    <FilesMatch "\.(js)$">
        Header set Cache-Control "private"
    </FilesMatch>
    <FilesMatch "\.(php|x?html?|pdf|xlsx?|docx?|pptx?|zipx?)$">
        Header set Cache-Control "private, must-revalidate"
    </FilesMatch>
#PHP/HTML specific headers
    <FilesMatch "\.(php|x?html?)$">
        Header always set X-Frame-Options "SAMEORIGIN"
        Header always set X-DNS-Prefetch-Control "on"
        Header always set Connection "keep-alive"
        Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        Header always set Referrer-Policy "strict-origin-when-cross-origin"
        Header always set X-Clacks-Overhead "GNU Terry Pratchett"
    </FilesMatch>
 </IfModule>
#END Headers