And if any of the websites use .NET, they can get almost all of the recommended security headers in one line by using a NuGet package I created: https://gaprogman.github.io/OwaspHeaders.Core/

It’s ridiculous that the answer to a secure web is for everyone to sprinkle the magic salt and not something on the browser side

Nice work! You gave me something to fix!!