Every response your server sends carries headers, which are short instructions the visitor never sees. A handful of them control browser security features. They cost nothing, need no code changes inside your app, and each one closes off a class of attack.
The common set is Strict-Transport-Security to keep visitors on HTTPS, Content-Security-Policy to limit where scripts and other resources may load from, X-Frame-Options or the frame-ancestors directive to stop clickjacking, X-Content-Type-Options set to nosniff so files are not reinterpreted as scripts, Referrer-Policy to limit what your URLs reveal to other sites, and Permissions-Policy to switch off device features you do not use.
Most hosts and frameworks send few or none of these by default, and AI tools rarely add them because the app works without them. They are set in one place, such as your framework's config file or your host's headers file. Add them early, since a strict Content Security Policy is much easier to adopt before the app grows. Headers are a second layer and do not replace fixing the underlying bug.
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()