Why are these security headers needed?

Question

Web development

In the WordPress admin panel:



Your website does not send all recommended security headers.

Upgrade Insecure Requests
X-XSS protection
X-Content Type Options
Referrer-Policy
X-Frame-Options
Permissions-Policy
HTTP Strict Transport Security

Does this really make sense, what does it affect?

Answer 1

Everything is perfectly googled - there is no point in doing it for you.
The only thing is that X-XSS protection is no longer needed because:
a) it is outdated and unnecessary for the main modern browsers
b) theoretically (within the margin of error) it can be harmful to users of the Safari browser.
If configuration requests blocking when XSS attacks are detected, which is potentially dangerous as it allows attackers to selectively disable portions of JavaScript code. The only safe approach is to explicitly disable browser-based XSS protection.
Some browsers ship with so-called XSS Auditors, built-in defenses against XSS. Although these defenses work against simple reflective XSS attacks, they can be abused by skillful attackers to add weaknesses to otherwise secure web sites. These dangers are present in both filtering and blocking modes. At this time, the Safari ships browser with its XSS defenses enabled by default. For this reason, the best approach is to explicitly disable this functionality.