every site we ship scores top marks on the common security scanners. it's a nice badge, but a badge isn't the point. the point is what those headers actually buy the client, and why almost nobody mentions it.
what the headers actually do
a handful of http security headers quietly do real work. a content security policy makes it much harder for an attacker to inject and run their own scripts on your page. strict transport security forces every connection over https so traffic can't be silently downgraded and intercepted. frame protections stop your site being loaded inside someone else's to trick your users. none of this is visible to a visitor. all of it protects them.
why most builds skip it
it's invisible until it isn't. a freelancer or a quick template build has no reason to spend time on something the client will never see and never ask about. so it gets skipped, and the site ships with its defences wide open. it works fine, right up until the day it doesn't.
how to actually sell it
the mistake is talking about it the way i just did, in jargon. clients don't buy headers. reframe it around them. your customers' data is harder to intercept. your site is harder to deface or hijack. your brand is harder to impersonate. that's the same thing said in the language of their reputation and their customers' trust, which is what they're actually paying to protect.
it's nearly free to do right
here's the part that makes it a genuine differentiator. on a modern stack this is mostly configuration, done once, at build time. it costs almost nothing to get right, and it sets a build apart from the wordpress-and-plugins crowd who never touch it. a strong security posture is one of the few things that is both cheap to deliver and easy to value.
so yes, the score is a marketing line. but only because the thing underneath it is real.