Tuning the security of a hosted platform
On a hosted platform (a website builder or a hosted webshop) the platform decides what you can set. Some headers you can set through its own controls, others are the platform's and not yours to change. What is possible depends on your plan, so check it against your current plan.
Response headers (CSP, HSTS, X-Frame-Options)
Through the custom-code or head block you can often add a Content-Security-Policy as a meta tag, which covers some of what a CSP header does. Real response headers such as HSTS and X-Frame-Options are not that: you cannot set them as a meta tag. Full control then needs the platform's top plan controls or a reverse proxy (Cloudflare, say) in front, as far as the domain setup allows.
In the page (trackers after consent)
Trackers that may load only after consent are handled in the embed or custom-code block where the script sits. The usual route is a tag manager that waits for consent, so analytics and advertising load only after an answer.
The connection (HTTPS and the certificate)
On a hosted platform HTTPS and the certificate are the platform's own, and usually handled well. A finding here is therefore more often a misconfiguration to raise with the platform than something you set yourself.
DNS records (SPF, DMARC, DNSSEC, IPv6)
These sit apart from your site: they are records at your domain. Set them with your DNS provider or domain registrar, not in your CMS or on your host. SPF and DMARC govern who may send mail as your domain, DNSSEC signs your DNS, and IPv6 is the one where the host has to offer an AAAA record and a connection before you can add it.