The plugin can send common browser headers: nosniff, a frame policy, Referrer-Policy, Permissions-Policy (camera, mic, geo, payment, USB off), X-Permitted-Cross-Domain-Policies none, and X-XSS-Protection 0. Optional front-end Content-Security-Policy and HSTS (HTTPS only) are off until you turn them on.

wp-admin stays safe to use. Frame policy inside wp-admin is always SAMEORIGIN so the customizer and plugin previews keep working. Front-end CSP is never applied on wp-admin screens.

Changes apply on the next site check-in. You never change DNS.

Open Protect or What the firewall blocks.