No clickjacking protection
Effort to fix: Quick win (under an hour)
Why it matters
Any site can embed yours in an invisible frame and trick visitors into clicking buttons they can't see.
How to fix it
Send X-Frame-Options: DENY (or SAMEORIGIN), or better, Content-Security-Policy: frame-ancestors 'none' (or 'self').
On WordPress
WordPress already protects wp-admin and the login page; add the header site-wide at the server or CDN.