diff --git a/src/components/SiteFooter.astro b/src/components/SiteFooter.astro
index bfd543e..b11971a 100644
--- a/src/components/SiteFooter.astro
+++ b/src/components/SiteFooter.astro
@@ -7,10 +7,10 @@ const whatsappAriaLabel = 'Contactar con MNQ por WhatsApp';
     <div class="footer-inner">
 
       <div class="footer-brand">
-        <a href="/" aria-label="MNQ Catering y Eventos">
+        <a href="/" aria-label="MNQ Catering y Evento">
           <img
             src="/images/logo-secondary.webp"
-            alt="MNQ Catering y Eventos"
+            alt="MNQ Catering y Evento"
             width="224"
             height="224"
             style="height: 3.5rem; width: auto; mix-blend-mode: multiply; margin-bottom: 1rem;"
diff --git a/src/components/SiteHeader.astro b/src/components/SiteHeader.astro
index 83faca9..12eebbb 100644
--- a/src/components/SiteHeader.astro
+++ b/src/components/SiteHeader.astro
@@ -17,10 +17,10 @@ const links = [
 <header class="site-header">
   <div class="page-wrap">
 
-    <a href="/" class="site-brand-link" aria-label="MNQ Catering y Eventos — inicio">
+    <a href="/" class="site-brand-link" aria-label="MNQ Catering y Evento — inicio">
       <img
         src="/images/logo-nav-dark.webp"
-        alt="MNQ Catering y Eventos"
+        alt="MNQ Catering y Evento"
         class="site-logo-banner"
         width="600"
         height="232"
diff --git a/src/middleware.ts b/src/middleware.ts
index 7523941..0b8c805 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -15,7 +15,7 @@ const CANONICAL_HOST = 'www.mnqeventos.es';
  * behind a proxy) actually arrives in production. If the proxy doesn't
  * forward the original host, this check will see the wrong value.
  */
-export const onRequest = defineMiddleware((context, next) => {
+export const onRequest = defineMiddleware(async (context, next) => {
   const requestHost = context.url.host;
 
   if (requestHost !== CANONICAL_HOST) {
@@ -23,5 +23,24 @@ export const onRequest = defineMiddleware((context, next) => {
     return context.redirect(redirectUrl.toString(), 301);
   }
 
-  return next();
+  const response = await next();
+
+  // Baseline security headers (flagged missing in the 2026-09-15 SEO/security
+  // audit — no HSTS, X-Content-Type-Options, X-Frame-Options, or
+  // Referrer-Policy were present on any response).
+  //
+  // Deliberately NOT setting Content-Security-Policy here: the site relies on
+  // inline <script> blocks (no nonce/hash setup), inline style="" attributes
+  // throughout every page, and an optional analytics script loaded from a
+  // runtime-configured host (PUBLIC_UMAMI_URL). A CSP tight enough to matter
+  // would need nonces wired through every inline script/style or it will
+  // silently break rendering/interactivity in production. Needs its own pass
+  // with live testing, not a guess baked in here.
+  response.headers.set('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload');
+  response.headers.set('X-Content-Type-Options', 'nosniff');
+  response.headers.set('X-Frame-Options', 'DENY');
+  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+  response.headers.set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
+
+  return response;
 });