I feel like there's a lot of variation in the suggested HTTP headers.
Commonly I see suggestions for:
HTTP Strict Transport Security
Content Security Policy
The use of which headers do you generally advise? And as a follow up question: Do the suggested headers for REST APIs differ?