I still haven’t managed to solve this issue. I’ve got wordfence security but there don’t appear to any settings in there that will fix this.
I found this on another website but I really would like to know if this is safe
2DogsDesign
It suggests to add this to the .htaccess file
Header always append X-Frame-Options DENY
Header set X-Content-Type-Options nosniff
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
Header always set X-XSS-Protection "1; mode=block"
Header set Content-Security-Policy "script-src 'unsafe-inline' 'unsafe-eval' http: https:"
Is there a better way? I would prefer not to add another plugin if possible
Thanks