The idea

Free defence-in-depth, delivered as headers.

Security headers are instructions to the browser, sent with every response. A handful of them harden a site against whole attack classes for almost no engineering cost.