HTTPS security headers of a public website's homepage (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) with concrete fixes.