Your Hosted Blog Got an F on a Security Headers Scan: What a Meta Tag Can Actually Fix

Most of the points a security headers scanner takes off a hosted blog are for HTTP response headers. Those come from the host. A theme only controls HTML, and only two of these policies work from HTML