How should security headers be designed for production?

For production, configure HTTPS and HSTS appropriately, use CSP tailored to the application, prevent unwanted framing, set secure cookie attributes separately, test headers in each environment, and avoid obsolete headers that provide no protection. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.