What's wrong: Security headers: no Content-Security-Policy.
Show me the fix
Minimum hardening set — X-Content-Type-Options: nosniff · X-Frame-Options: DENY · Referrer-Policy: strict-origin-when-cross-origin · Permissions-Policy: camera=(), microphone=(), geolocation=() · and a Content-Security-Policy starting with default-src 'self'. Move scripts/styles to external files or add nonces so the CSP doesn't need 'unsafe-inline'.
Before you apply: make one change at a time, then re-run this audit to confirm the check passes.