HTTP security headers ask the browser to apply protections: Strict-Transport-Security enforces HTTPS, X-Content-Type-Options: nosniff prevents type misinterpretation, Content-Security-Policy limits resources, X-Frame-Options or frame-ancestors control iframe embedding.
Example
Strict-Transport-Security: max-age=31536000; includeSubDomains