Website Headers: Content-Security-Policy + Permissions-Policy

[veloman]

So I occasionally do a website security audit using online tools, and whilst my setup is pretty good I always get told to add headers for Content-Security-Policy and Permissions-Policy. But I can't understand the best way to set them up.

Does anyone have a good idea of what is best for a forum?