Security headers should describe the actual page
Start with a narrow policy, then expand it only when a documented feature needs another resource.
Web-Security
HSTS should be rolled out with a recovery plan
HSTS is cached browser policy, so a configuration mistake can outlive the server change that created it.
CAA records should authorize the issuer you actually use
CAA narrows certificate issuance policy, but a mistaken record can block renewal as effectively as an expired certificate.
Cookie scope should be narrower than the application boundary
A cookie sent to more hosts or paths than necessary enlarges the impact of every mistake at those boundaries.
Content-Type should describe the bytes you actually send
A filename is only a hint; the response header is the browser-facing contract for the representation.