Content-Security-Policy is the powerful one and the fiddly one. It lists where scripts and styles may load from, which is what turns an injected script into a blocked request. Roll it out in report-only mode first and read the reports, because a policy applied blind will break something real.
They are defence in depth, not a fix. Headers reduce what a bug can do once you have one; they do not stop you having it. Check yours with a plain request rather than assuming, since a header that was never actually sent looks identical to one you meant to send.
Updated August 2026
Go deeper