No Content-Security-Policy
Effort to fix: Involved (plan it)
Why it matters
A CSP limits where scripts can load from, so a single cross-site scripting bug can't easily run attacker code or steal sessions.
How to fix it
Start with Content-Security-Policy-Report-Only listing the script, style, image and frame origins you use, watch the reports, then switch to enforcing. Aim for nonce- or hash-based script-src without 'unsafe-inline'.
On WordPress
Themes and plugins often inject inline scripts, so begin in Report-Only mode. A security-headers plugin or your CDN can set the header; tighten per page builder and plugin.