Fix it on your platform
Concrete advice for what the check reports, per platform, with code you can copy. Pick yours, or run the check first and you see what your site is missing.
Tuning the security of a WordPress site
WordPress gives you full control over your headers and the shape of your page, so almost everything this check reports is yours to fix. Below, per kind of finding, where the fix lives, with code you can copy. WooCommerce is plain WordPress for these fixes: it is a plugin, so the header fix is the WordPress one.
Tuning the security of a Craft CMS site
Craft gives you full control over your headers and your markup, so almost everything this check reports is yours to fix. Below, per finding, where the fix lives, with code you can copy.
Tuning the security of a Next.js site
On Next.js you set the headers in your own config or middleware, not in a CMS. Below, per finding, where the fix lives, with code you can copy.
Tuning the security of an Astro site
Where you set the headers on Astro depends on your output. A server-rendered (SSR) site can set them in middleware; a static build serves no headers from Astro, so then they belong on the host. Below, per finding, where the fix lives.
Tuning the security of a Drupal site
Drupal gives you full control: you set repairs on the web server, through a module, or in the markup. Two headers, incidentally, core already sets itself. Below, per finding, where the fix lives, with code you can copy.
Tuning the security of a Joomla site
Joomla has had a built-in plugin for security headers since version 4, so much of this you can switch on without code. Below, per finding, where the fix lives.
Platform not on the list?
Tuning the security of a self-hosted CMS
When you run a CMS or webshop on your own server, you decide the headers and the shape of the page. Where a repair goes depends on what is wrong. Below, per kind of fix, where it belongs, whatever CMS you run.
Tuning the security of a headless or framework site
When your site runs on a framework or a separate frontend that pulls content from a headless CMS, the headers are set on the frontend host, not in the CMS. This is the correction that matters most: generic advice sends a headless owner to the wrong place.
Tuning the security of a hosted platform
On a hosted platform (a website builder or a hosted webshop) the platform decides what you can set. Some headers you can set through its own controls, others are the platform's and not yours to change. What is possible depends on your plan, so check it against your current plan.