Know what attackers can see. Fix what matters first.

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
add_header Content-Security-Policy "default-src 'self'; object-src 'none';" always;
curl -I https://yourdomain.com

Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
Header always set Content-Security-Policy "default-src 'self'; object-src 'none';"
apachectl configtest && systemctl reload apache2

import helmet from "helmet";
app.use(helmet({
  contentSecurityPolicy: { useDefaults: true }
}));

session_set_cookie_params([
  "secure" => true,
  "httponly" => true,
  "samesite" => "Lax"
]);