user_register_form) and choose the enabled CAPTCHA type on it, or keep it as the default challenge configured for the site
Example: an uppercase constraint (with a parameter of 2) and a digit constraint (with a parameter of 4) means that a user password must have at least 2 uppercase letters and at least 4 digits for it to be accepted.
X-XSS-ProtectionHTTP response header controls Microsoft Internet Explorer, Google Chrome and Apple Safari internal XSS filters.
Feature-Policyheader to selectively enable, disable, and modify the behavior of certain APIs and web features in the browser. See Google's developer documentation.
From-OriginHTTP response header
Referrer-PolicyHTTP response header