Improving SEO for Service Website

need to fix Heading structure,Non-clickable phone numbers ,Missing quotes on attributes, AVIF support , Missing image alt attributes Missing aria labels Missing roles Missing html lang attribute Missing form labels Header OK Notice Warning Critical Recommendation Strict-Transport-Security 0 0 0 120 Strict-Transport-Security header is not set. It enforces secure connections and protects against MITM attacks. X-XSS-Protection 44 0 0 76 X-XSS-Protection header is not set. It enables browser's built-in defenses against XSS attacks. Content-Security-Policy 117 0 0 3 Content-Security-Policy header is not set. It restricts resources the page can load and prevents XSS attacks. X-Powered-By 0 0 0 115 X-Powered-By header is set to 'PHP/8.1.34'. It is better not to reveal the technologies used and especially their versions. X-Frame-Options 0 45 75 0 X-Frame-Options header is set to SAMEORIGIN which allows this origin to embed the resource in a frame. X-Frame-Options header is not set. It prevents clickjacking attacks when set to 'deny' or 'sameorigin. X-Content-Type-Options 45 0 75 0 X-Content-Type-Options header is not set. It stops MIME type sniffing and mitigates content type attacks. Referrer-Policy 45 0 75 0 Referrer-Policy header is not set. It controls referrer header sharing and enhances privacy and security. Feature-Policy 0 0 120 0 Feature-Policy header is not set. It allows enabling/disabling browser APIs and features for security. Not important if Permissions-Policy is set. Permissions-Policy 0 0 120 0 Permissions-Policy header is not set. It allows enabling/disabling browser APIs and features for security. Set-Cookie 0 0 2 0 Set-Cookie header for 'PHPSESSID' does not have 'HttpOnly' flag. Attacker can steal the cookie using XSS. Consider using 'HttpOnly' when cookie is not used by JavaScript. Server 0 120 0 0 Server header is set to 'hcdn'. It is better not to reveal used technologies. SEO metadata for all pages etc etc we need this for whole website