How to fix XSS Protection on https://example.com/wp-includes/css/

Solution:

Put this in your functions.php file:

add_action('send_headers', function(){
    // Enforce the use of HTTPS
    header("Strict-Transport-Security: max-age=31536000; includeSubDomains");
    // Prevent Clickjacking
    header("X-Frame-Options: SAMEORIGIN");
    // Prevent XSS Attack
    header("Content-Security-Policy: default-src 'self';"); // FF 23+ Chrome 25+ Safari 7+ Opera 19+
    header("X-Content-Security-Policy: default-src 'self';"); // IE 10+
    // Block Access If XSS Attack Is Suspected
    header("X-XSS-Protection: 1; mode=block");
    // Prevent MIME-Type Sniffing
    header("X-Content-Type-Options: nosniff");
    // Referrer Policy
    header("Referrer-Policy: no-referrer-when-downgrade");
}, 1);

You can use it as it is or you can remove things that u dont need

Source: https://benrabicoff.com/adding-secure-http-response-headers-wordpress/