Open your browser's network tab on almost any small business website and you'll likely find half the standard security headers missing. Here's what each one actually does.
Strict-Transport-Security (HSTS)
Tells browsers to never connect over plain HTTP again, even if a user types http:// by mistake. Without it, a single unencrypted request is enough for an attacker on the same network to intercept traffic.
Content-Security-Policy (CSP)
Restricts which scripts, styles, and resources a browser is allowed to load on your page. This is your main defense against cross-site scripting (XSS) — even if an attacker manages to inject a <script> tag, a correctly configured CSP stops it from running.
X-Frame-Options
Prevents your site from being loaded inside an <iframe> on someone else's domain — the standard defense against clickjacking, where a malicious page overlays invisible buttons over your real site's UI.
X-Content-Type-Options: nosniff
Stops browsers from guessing a file's content type. Without it, a file uploaded as an "image" that's actually HTML/JS can sometimes be executed instead of displayed.
Referrer-Policy
Controls how much of your URL gets sent to third parties when a user clicks an outbound link — relevant if your URLs contain anything sensitive (session tokens, internal paths).
None of these require touching application code — they're usually one or two lines in your web server or CDN config. A free header scan will tell you exactly which ones you're missing on your domain right now.