Enforces HTTPS — prevents protocol downgrade and cookie hijacking attacks

Controls resource loading — primary defence against XSS attacks

Prevents clickjacking by blocking iframe embedding from other origins

Stops MIME-type sniffing — prevents content type confusion attacks

Controls referrer data sent with requests — protects user privacy

Restricts access to browser APIs like camera, microphone and geolocation