Security headers that matter: CSP, HSTS and friends

Run any site through a header scanner and you’ll get a letter grade and a list of a dozen headers you’re “missing”. Some of them matter a lot. Some do almost nothing in 2026. One of them, if you follow old advice, can make things slightly worse. Chasing the grade is how teams end up…