Tangentially, I’d argue that it’s missing an HSTS policy of redirecting pages to a canonical HTTPS version; e.g. TFA should be linked as https://fabiensanglard.net/doom_psx/