Explain important HTTP security headers and their purposes.

Key headers: Content-Security-Policy (prevent XSS, control resource loading), Strict-Transport-Security (force HTTPS), X-Content-Type-Options (prevent MIME sniffing), X-Frame-Options (prevent clickjacking), Referrer-Policy (control referrer info), Permissions-Policy (control browser features), Cross-Origin-Opener-Policy/Embedder-Policy (enable cross-origin isolation). Implementation: set at reverse proxy/CDN level. Test with: securityheaders.com. Balance security vs functionality. CSP requires careful rollout (report-only mode first).