For what it’s worth/to prevent too much FUD about something as important as secure by default, Django has fantastic security header defaults out of the box too. https://docs.djangoproject.com/en/2.2/ref/middleware/#module...