Modern application security covers far more than HTTP headers.
Identity and access
Review authentication, authorization, session management and least-privilege access.
Input and output
Validate untrusted input and encode output to reduce injection and cross-site scripting risk.
Business logic
Test workflows for authorization bypasses, abuse cases and unexpected state transitions.