CORS Header

You can (and arguably should) add the headers directly in your webserver’s configuration…

Or let a WordPress plugin do it for you:

https://www.ads-software.com/plugins/http-headers/

https://www.ads-software.com/plugins/headers-security-advanced-hsts-wp/

I agree with George that your server configuration is likely the best approach, but if you want to have WP send certain headers and prefer to roll your own code, you can use the “wp_headers” filter to do so.