You are missing the following security headers on your site:

X-Frame-Options Permissions-Policy X-Content-Type-Options