Headers shape browser behaviour.
A small set of correct headers is more useful than an elaborate set copied without context.
Content-Type and representation
Content-Type identifies the representation type. An HTML page ordinarily uses text/html, CSS uses text/css, and an SVG resource uses image/svg+xml. Incorrect types can interfere with browser rendering and content security protections.
Use X-Content-Type-Options: nosniff when the application correctly serves its types. Do not add it to compensate for inconsistent MIME settings.
Caching is a contract
A stable fingerprinted asset may be cached longer than a frequently changing HTML document. ETag and Last-Modified let clients perform conditional requests, but they should not be invented as a random value per response.
Use Cache-Control deliberately. Misconfigured caches can make an updated page appear stale or disclose private responses.
Security headers need context
Content Security Policy should reflect the site’s real resources. HSTS is suitable only when the HTTPS lifecycle and affected subdomains are understood. Blindly applying includeSubDomains can break unrelated services.
Before adding security directives globally, check every virtual host and endpoint that shares the policy.