whonix.org should use a Content-Security-Policy. Other security headers besides CSP are looking good already (test service).

https://forums.whonix.org/t/whonix-website-security-rating-b-mozilla-observatory