This post has really good info on HTTP security headers.
https://blog.appcanary.com/2017/http-security-headers.html
X-XSS-Protection
Content Security Policy
HTTP Strict Transport Security (HSTS)
HTTP Public Key Pinning (HPKP)
X-Frame-Options
X-Content-Type-Options
Referrer-Policy
Cookie Options