Feature Requests

Disable directory listing on Apache servers via .htaccess; per Securi recommendation

For server configurations without (editable) .htaccess file, inserting Security Headers via PHP can be a viable solution.

Allow CSP report-uri to work while enforcing an existing CSP. This way one can constantly review new violations to allow items that should otherwise be allowed.

Cross-Origin Resource Policy allows a resource owner to specify who can load the resource.