Improving SEO for Service Website

need to fix Heading structure,Non-clickable phone numbers ,Missing quotes on attributes, AVIF support ,
Missing image alt attributes
Missing aria labels
Missing roles
Missing html lang attribute
Missing form labels
Header OK Notice Warning Critical Recommendation
Strict-Transport-Security 0 0 0 120 Strict-Transport-Security header is not set. It enforces secure connections and protects against MITM attacks.
X-XSS-Protection 44 0 0 76 X-XSS-Protection header is not set. It enables browser's built-in defenses against XSS attacks.
Content-Security-Policy 117 0 0 3 Content-Security-Policy header is not set. It restricts resources the page can load and prevents XSS attacks.
X-Powered-By 0 0 0 115 X-Powered-By header is set to 'PHP/8.1.34'. It is better not to reveal the technologies used and especially their versions.
X-Frame-Options 0 45 75 0 X-Frame-Options header is set to SAMEORIGIN which allows this origin to embed the resource in a frame.
X-Frame-Options header is not set. It prevents clickjacking attacks when set to 'deny' or 'sameorigin.
X-Content-Type-Options 45 0 75 0 X-Content-Type-Options header is not set. It stops MIME type sniffing and mitigates content type attacks.
Referrer-Policy 45 0 75 0 Referrer-Policy header is not set. It controls referrer header sharing and enhances privacy and security.
Feature-Policy 0 0 120 0 Feature-Policy header is not set. It allows enabling/disabling browser APIs and features for security. Not important if Permissions-Policy is set.
Permissions-Policy 0 0 120 0 Permissions-Policy header is not set. It allows enabling/disabling browser APIs and features for security.
Set-Cookie 0 0 2 0 Set-Cookie header for 'PHPSESSID' does not have 'HttpOnly' flag. Attacker can steal the cookie using XSS. Consider using 'HttpOnly' when cookie is not used by JavaScript.
Server 0 120 0 0 Server header is set to 'hcdn'. It is better not to reveal used technologies.
SEO metadata for all pages
etc etc
we need this for whole website