X-Frames-Options value won’t change to Deny

Hello, I’m trying to update my security policy using the HTTP Headers plugin. I’ve set the value of X-Frames-Options to “Deny” but it’s still showing up as “SAME ORIGIN”. The same thing is happening with my content security policy. img-src is showing up as “*” instead of “self”.

Does anyone know of another plugin that has the same features as HTTP Headers? Or can I just edit the PHP file directly to make the changes?

Thanks!