What is security headers?

HTTP security headers instruct browsers to apply protections such as transport enforcement, framing restrictions, content-type handling, referrer behavior, and Content Security Policy. They reduce browser attack surface but do not replace secure application code.