Missing X-Content-Type-Options
Effort to fix: Quick win (under an hour)
Why it matters
Without nosniff, browsers may guess a file's type and execute an uploaded file as script.
How to fix it
Send X-Content-Type-Options: nosniff on all responses.
On WordPress
Add it at the server/CDN level; it's a one-line header and safe for WordPress.