The only security header our site sends is HSTS, and 74 of our 76 pages tell any origin it may read them

A header sweep of every public page: 18 header names, zero of the five everybody recommends, and the two pages that differ from the other 74 in four ways at once. Then what a Content Security Policy would actually cost us, measured rather than guessed.