Strict Content-Security-Policy (the site has no inline script or style), nosniff, referrer and permissions policies, no Server header, no-cache for HTML and five-minute caching for unfingerprinted assets.
jzzliu