Add HSTS and some other security headers