Improve Security headers on greenpeace.org

Per ticket from Jelle in NL.

You can use this website to check the same thing he is reporting:
https://securityheaders.com/?q=greenpeace.org%2Fjctest&hide=on&followRedirects=on
This is for the P4 infra team i think: an Opensource intelligence scan found some recommendations for the greenpeace.org website.
 
Here are two screenshots, is that something that should be improved perhaps?
Just a heads up... i'll leave the decision on whether or not to act on that info with you )