There are some http security headers in the world of cyber security of web applications. These are e.g.:

- X-Content-Type-Options
- X-Frame-Options
- Content-Security-Policy
- Referrer-Policy
- Strict-Transport-Security
- Expect-CT
- X-XSS-Protection (deprecated)
- etc.

All of them are instructions for web browsers as far as I know. When a web browser takes this instruction that comes from http response packet of web application server, it behaves according to related to http security header's job in "client side". All is fine. But, the thing which I wonder is: 

When these http security headers are used in a web service server instead of a web application server (e.g. SOAP web service server, or REST API web server), these security headers are still functional to use? 

For instance; if consumer of a web service server is a web application, then client is web browser. Then are these security headers functional in this situation or redundant? 

Or is it like that: Consumer of a web service doesn't matter, all these http security headers are functional in just web applications?

Shortly, are http security headers only for web browsers? This question's answer will clarify the situation. If question's answer is yes, then http security headers are functional when a web service consumer is an web application, right?