Case: Five Headers Moved Observatory From F to A+

Case: Five Headers Moved Observatory From F to A+
Client site scored F on Mozilla Observatory (15/100). No security headers present.

Header SOP, added at the edge:

— Step 1: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
— Step 2: Content-Security-Policy — start in Report-Only, collect 7 days of violations, then enforce.
— Step 3: X-Content-Type-Options: nosniff
— Step 4: Referrer-Policy: strict-origin-when-cross-origin
— Step 5: Permissions-Policy — disable camera, microphone, geolocation.

Outcome: Score moved 15/100 (F) to 110/100 (A+). CSP report-only caught 3 inline scripts we fixed before enforcing. Zero front-end breakage at cutover.

Run this every time.