Good blog post with details on the different security headers and how to set them.
- XSS-Protection
- Content Security Policy
- HTTP Strict Transport Security (HSTS)
- HTTP Public Key Pinning (HPKP)
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy
- Cookie Options