Here is a code example from one of my sites. The code can be added in functions.php or by using any plugin allowing you to add custom code snippets.
// Add HTTP security headers to website
add_action('send_headers', function() {
header( 'X-Frame-Options: SAMEORIGIN' );
header( 'X-XSS-Protection: 1; mode=block' );
header( 'X-Content-Type-Options: nosniff' );
header( 'X-Permitted-Cross-Domain-Policies: none' );
header( 'Strict-Transport-Security: max-age=31536000; includeSubDomains; preload' );
header( 'Content-Security-Policy: upgrade-insecure-requests' );
header( 'Referrer-Policy: no-referrer-when-downgrade' );
header( 'Permissions-Policy: camera=(), microphone=()' );
// This part removes the X-Powered-By header, PHP might not always allow this header to be removed.
header_remove('X-Powered-By');
});
