Steps to reproduce the issue

I activate the plugin 'System - HTTP Header'.
Activated options on CSP tab.
Adding some directives:

• Policy Directive default-src, Value 'self', Client Both
• Policy Directive script-src, Value 'self', Client Site
• Policy Directive style-src, Value 'self' 'unsafe-inline', Client Site
• Policy Directive img-src, Value 'self' data:, Client Site

Now after scanning with securityheaders.com, I receve this warning:
Content-Security-Policy No valid directives found in policy.

Expected result

The CSP directives are interpreted

Actual result

On Header response there's no values:
content-security-policy:
content-security-policy-report-only:

System information (as much as possible)

Joomla 5.3.1
PHP 8.3.22

Additional comments