* Improvement: Use ABSPATH constant instead of path when writing path to debug.log
* Improvement: Pause CSP reporting after 20 requests, to lower server load
* Fix: script-src-elem in Content Security Policy not including source URL
* Improvement: CSP policy for back and front-end separate
* Improvement: also allow non-recommended X-XSS options
* Improvement: frame ancestors allow other values than 'none'
* New: automatically detect wrong Security Header values from other sources, and duplicate headers
* Improvement: auto enable Insecure Requests header only when SSL enabled
* Improvement: remove unnecessary notices load in licenses block
* Fix: isset check on $_SERVER['HTTPS'] to support environments where this key is missing
* Improvement: add headers_sent() check for situations where the headers already have been sent, possibly due to an error earlier in the system.
* Improvement: Update CSP reporting URI on permalink structure change
* Fix: HSTS not running on hosting environments with load balanced configuration because SSL is not detected
* Fix: when wp-config.php is not writable, renaming database prefix could cause tables to get removed
* Prepare for 6.0 release with upgrade notice, disabling auto updates for 6.0, and code preparation to prevent conflicts between major versions
= 5.5.3 =
* Fix: advanced-headers.php did not generated CSP correctly
* Fix: Browsers support for new report-to reporting attribute not good enought to use it yet.