Content-Security-Policy (CSP) is an HTTP header that tells the browser which sources of content (scripts, styles, images, fonts, iframes) are trusted and allowed to load on your page. A properly configured CSP prevents cross-site scripting (XSS) attacks by blocking the execution of injected scripts — even if an attacker manages to inject malicious JavaScript into your page, the browser refuses to execute it if the source isn't whitelisted. CSP is one of the most powerful security headers but also the most complex to configure correctly — overly permissive policies (with 'unsafe-inline' or wildcard sources) provide little protection, while overly strict policies break legitimate functionality.

HTTP Strict-Transport-Security (HSTS) tells browsers that your site should only be accessed over HTTPS, and to refuse HTTP connections for a specified period (max-age). Without HSTS, even an HTTPS site is vulnerable to SSL stripping attacks — where a man-in-the-middle intercepts the first HTTP request before it redirects to HTTPS. With HSTS, browsers remember they must use HTTPS and refuse the initial HTTP connection, preventing this attack vector entirely. The recommended max-age is 1 year (31536000 seconds). The includeSubDomains directive extends protection to all subdomains; preload submits your domain to browsers' built-in HSTS preload list.

Clickjacking is an attack where a malicious page embeds your website in an invisible iframe, positioning it over an interface element on the attacker's page. When users click what they think is a button on the attacker's site, they're actually clicking on your site — potentially triggering purchases, account deletions, or other actions. X-Frame-Options: DENY prevents your page from being framed at all; SAMEORIGIN allows framing only by pages on the same domain. The newer Content-Security-Policy frame-ancestors directive is more flexible but X-Frame-Options remains widely supported for legacy browsers.

Security headers are tiny text additions to HTTP response headers — they have negligible performance impact. The one exception is Content-Security-Policy, which can cause minor processing overhead as the browser parses and enforces the policy for each resource load, but this is measured in microseconds and imperceptible to users. The Strict-Transport-Security header actually improves performance after initial setup — by preventing HTTP→HTTPS redirects on repeat visits, it saves one round trip per session for returning visitors. Security headers are entirely free in performance terms relative to their security benefit.