Security headers tell a browser which capabilities to allow.

Content-Security-Policy restricts where scripts, styles, images, and other resources may load from.
X-Content-Type-Options: nosniff tells the browser to respect declared content types.
Referrer-Policy limits referrer information sent to other sites.
Permissions-Policy controls selected browser features.
frame-ancestors inside CSP controls which pages may embed yours.

A strict policy can break an existing site, so deploy carefully. Start by inventorying required sources. CSP can run in report-only mode while you observe violations.

Headers reduce risk but do not repair unsafe application code. You still need output escaping, input validation, secure authentication, and current dependencies.

Quick check

Result

You got of right.