Make this test happy: https://observatory.mozilla.org/analyze.html?host=www.behnaboso.sk

.htaccess

<ifModule mod_headers.c>

# Content Security Policy
# Content Security Policy (CSP) header not implemented

# This is what you should do, really:
#   Header unset Content-Security-Policy
#   Header set Content-Security-Policy "default-src 'self'"
#
# Below is what I had to do.
# (Allow Google Analytics, Fonts, some sharebar nonsense and a couple of other things. Probably really useful are img-src * and media-src * to allow images and media from anywhere.)

Header unset Content-Security-Policy
Header set Content-Security-Policy "default-src 'self'; img-src *; media-src *; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://*.sharethis.com; font-src 'self' https://fonts.gstatic.com data:; script-src 'self' 'unsafe-inline' https://www.google-analytics.com http://cdn.mouseflow.com http://api.instagram.com https://*.sharethis.com; frame-src 'self' https://*.sharethis.com; connect-src 'self' https://*.sharethis.com" 
# Support for older browsers that support X-Content-Security-Policy but not Content-Security-Policy
Header unset X-Content-Security-Policy
Header add X-Content-Security-Policy "default-src 'self'; img-src *; media-src *; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://*.sharethis.com; font-src 'self' https://fonts.gstatic.com data:; script-src 'self' 'unsafe-inline' https://www.google-analytics.com http://cdn.mouseflow.com http://api.instagram.com https://*.sharethis.com; frame-src 'self' https://*.sharethis.com; connect-src 'self' https://*.sharethis.com" 

# Cookies
# Session cookie set without using the Secure flag or set over http

# TODO ^

# Cross-origin Resource Sharing
# Content is visible via cross-origin resource sharing (CORS) file or headers

# What to put here?
Header set Access-Control-Allow-Origin https://www.behnaboso.sk

# HSTS 
# https://raymii.org/s/tutorials/HTTP_Strict_Transport_Security_for_Apache_NGINX_and_Lighttpd.html

Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"

# X-Content-Type-Options
# X-Content-Type-Options header not implemented

Header set X-Content-Type-Options "nosniff"

# X-Frame-Options
# X-Frame-Options (XFO) header not implemented

# Only allow my site to frame itself
Header set X-Frame-Options "SAMEORIGIN"

# X-XSS-Protection
# X-XSS-Protection header not implemented

Header set X-XSS-Protection "1; mode=block"

</ifModule>