What is Security header?

Also called HTTP security headers.

Security headers are short instructions your server sends with every page, telling the browser how to treat it — whether other sites may embed it, whether to insist on HTTPS, whether to guess at file types. Nothing breaks when they are missing, which is why they usually are.

In more detail

The ones that matter most are Strict-Transport-Security (always use HTTPS for this site), X-Frame-Options or frame-ancestors (do not let other sites embed my pages), X-Content-Type-Options (do not guess what a file is), Referrer-Policy (limit what you tell the next site about where the visitor came from), and Content-Security-Policy. Most are one line of configuration each.

Why it matters for your site

Their absence is invisible until it is exploited. Without frame protection, someone can load your real site inside their fake one and harvest what visitors type. Setting the first four takes about ten minutes.