Protecting site from XSS attacks

[Shammikit]

hello, i have setup a vulnerable website in Apache for testing different types of attacks. I have recognized it is vulnerable to XSS by scanning it using ZAP. I have also tried attacks to display alert messages and cookies by using the commands below by intercepting inputs using ZAP.

<script>alert('Hello world')</script>
<script>alert('document.cookie')</script>

Now i want to know how to prevent these attacks. I tried using the commands below in my httpd.conf file of Apache but im still able to carry out XSS attacks. 

Header set X-XSS-Protection "1; mode=block"

Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure

are there any issues in these commands or should i be doing something else? Is there a specific place that i should put the above commands in httpd.conf file because i just placed them towards the bottom.

Thankyou