Cabeceras de seguridad

Hola Ricardo.

Prueba añadiendo lo siguiente al final del archivo .htaccess:

<IfModule mod_headers.c>

# 1. Bloquea sniffing de MIME
Header always set X-Content-Type-Options "nosniff"

# 2. Anti-clickjacking 
Header always append X-Frame-Options "SAMEORIGIN"

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

# 4. Referrer Policy
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# 5. Permissions Policy 
Header always set Permissions-Policy "\
accelerometer=(), \
ambient-light-sensor=(), \
autoplay=(), \
battery=(), \
camera=(), \
cross-origin-isolated=(), \
display-capture=(), \
document-domain=(), \
encrypted-media=(), \
execution-while-not-rendered=(), \
execution-while-out-of-viewport=(), \
fullscreen=(), \
geolocation=(), \
gyroscope=(), \
keyboard-map=(), \
magnetometer=(), \
microphone=(), \
midi=(), \
navigation-override=(), \
payment=(), \
picture-in-picture=(), \
publickey-credentials-get=(), \
screen-wake-lock=(), \
sync-xhr=(), \
usb=(), \
web-share=(), \
xr-spatial-tracking=()"

# 6. Content-Security-Policy 
<IfModule mod_headers.c>
Header set Content-Security-Policy "\
default-src 'self'; \
script-src 'self' \
 https://www.youtube.com  \
 https://www.youtube-nocookie.com  \
 https://s.ytimg.com  \
'sha256' valores-de-nonced-inline si los identificas; \
script-src-attr 'none'; \
style-src 'self' \
'unsafe-inline' /* necesario para la mayoría de temas WP modernos */ ; \
img-src 'self' data:  https://www.gamesaelectric.com  https://*.wp.com  https://i.ytimg.com;  \
font-src 'self' data:; \
connect-src 'self' \
 https://www.youtube.com  \
 https://*.youtube.com  \
 https://*.ytimg.com;  \
media-src 'self'  https://*.youtube.com  https://*.ytimg.com blob:; \
frame-src 'self' \
 https://www.youtube.com  \
 https://youtube.com;  \
child-src 'self' blob:; \
object-src 'none'; \
base-uri 'self'; \
form-action 'self'; \
frame-ancestors 'self'; \
upgrade-insecure-requests; \
block-all-mixed-content;"
</IfModule>

</IfModule>

Options -Indexes
ServerSignature Off

Un saludo