Quick-win headers
HSTS (always use HTTPS), X-Content-Type-Options, framing protection and a Referrer-Policy can usually be added in minutes through your host, CDN or a plugin. Content-Security-Policy takes more care; start in report-only mode.
Write a one-page incident plan
Who to call (host, developer, registrar), where logins and backups are, how to take the site offline and how to tell customers. Keep a printed copy.
Re-check quarterly
Settings drift as sites change. Run the free check every few months and after any big change.
Do this today
Fill in the incident plan page and store a printed copy with your business records.