1. HTTP Security Headers Baseline Content-Security-Policy (CSP): Restricts allowed sources for scripts, styles, fonts, and iframes to prevent Cross-Site Scripting (XSS). Strict-Transport-Security (HSTS): Enforces HTTPS with max-age=31536000; includeSubDomains; preload. X-Content-Type-Options: Set to nosniff to prevent MIME-type confusion attacks. X-Frame-Options: Set to DENY or SAMEORIGIN to guard against clickjacking. Referrer-Policy: Set to strict-origin-when-cross-origin to prevent leaking full URLs to external trackers. 2. Cookie Hygiene & Session Flags Ensure all session cookies include the Secure flag to prevent transmission over plaintext HTTP. Ensure all sensitive authentication cookies include the HttpOnly flag to block client-side JavaScript access. Set SameSite=Lax or SameSite=Strict to mitigate Cross-Site Request Forgery (CSRF). Invalidate sessions immediately upon logout and enforce absolute session expiration after inactivity.