## IIS WebAdmin Module
    Import-Module WebAdministration

    $AppPoolInstance = Get-Item IIS:\AppPools\$AppPool

    Write-Output "Set Site PreLoadEnabled to true"
    Set-ItemProperty IIS:\Sites\$Site -name applicationDefaults.preloadEnabled -value True

    Write-Output "Set Recycling.periodicRestart.time  = 0"
    $AppPoolInstance.Recycling.periodicRestart.time = [TimeSpan]::Parse("0");
    $AppPoolInstance | Set-Item

    Write-Output "Set App Pool start up mode to AlwaysRunning"
    $AppPoolInstance.startMode = "alwaysrunning"

    Write-Output "Disable App Pool Idle Timeout"
    $AppPoolInstance.processModel.idleTimeout = [TimeSpan]::FromMinutes(0)
    $AppPoolInstance | Set-Item

    if ($appPoolStatus -ne "Started") {
        Write-Output "Starting App Pool"
        Start-WebAppPool $AppPool    
    } else {
        Write-Output "Restarting App Pool"
        Restart-WebAppPool $AppPool
    }

{
    "RoslynExtensionsOptions": {
        "EnableAnalyzersSupport": true,
        "LocationPaths": [
        ]
    }
}

public class MyDesignTimeServices : IDesignTimeServices
{
    public void ConfigureDesignTimeServices(IServiceCollection services)
        => services.AddEntityFrameworkSqlServerNetTopologySuite();
}

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <!-- SECURITY HEADERS - https://securityheaders.io/? -->
      <!-- Protects against Clickjacking attacks. ref.: http://stackoverflow.com/a/22105445/1233379 -->
      <add name="X-Frame-Options" value="SAMEORIGIN" />
      <!-- Protects against Clickjacking attacks. ref.: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet -->
      <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains"/>
      <!-- Protects against XSS injections. ref.: https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-headers/ -->
      <add name="X-XSS-Protection" value="1; mode=block" />
      <!-- Protects against MIME-type confusion attack. ref.: https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-headers/ -->
      <add name="X-Content-Type-Options" value="nosniff" />
      <!-- CSP modern XSS directive-based defence, used since 2014. ref.: http://content-security-policy.com/ -->
      <add name="Content-Security-Policy" value="default-src 'self'; font-src *;img-src * data:; script-src *; style-src *;" />
      <!-- Prevents from leaking referrer data over insecure connections. ref.: https://scotthelme.co.uk/a-new-security-header-referrer-policy/ -->
      <add name="Referrer-Policy" value="strict-origin" />
    </customHeaders>
  </httpProtocol>
</system.webServer>