The headers checked
Strict-Transport-Security tells browsers to use HTTPS for your domain for a set period, so a user typing the bare address is never sent over plain HTTP. X-Frame-Options controls whether your pages can be embedded in a frame on another site, which is what prevents clickjacking.
X-Content-Type-Options with the value nosniff stops browsers second-guessing the content type you declared, closing a class of attack where an uploaded file is interpreted as script. Content-Security-Policy restricts where scripts, styles and other resources may load from, and is the strongest defence against cross-site scripting. Referrer-Policy controls how much of the current URL is sent when a user follows a link away.
Where to start if several are missing
Add them in order of effort against benefit. X-Content-Type-Options and Referrer-Policy are single lines with essentially no risk of breaking anything. X-Frame-Options is nearly as easy unless you deliberately embed your own pages elsewhere.
Strict-Transport-Security needs slightly more thought, because once a browser has seen it, it will refuse plain HTTP for your domain for the max-age you specified. Start with a short max-age, confirm everything works over HTTPS, then raise it.
Content-Security-Policy is by far the most work and the most valuable. Deploy it with Content-Security-Policy-Report-Only first, collect violations, and only enforce once the policy no longer breaks legitimate resources.
Headers are not a substitute for fixing the code
These headers reduce the impact of vulnerabilities; they do not remove them. A strong CSP makes cross-site scripting much harder to exploit, but the underlying injection flaw is still there, and CSP can be bypassed.
Treat them as defence in depth. A site with perfect headers and unvalidated input is not secure, and a scan that reports all headers present is measuring one narrow thing.
Why a check might fail entirely
The tool requests https://yourdomain and follows redirects. If the domain does not resolve, refuses connections, or presents a certificate that cannot be validated, no headers can be read and the check reports the error instead.
Sites that block requests from datacenter addresses, or that require a browser fingerprint, may also refuse. That is a property of their protection rather than a header problem.
Frequently asked questions
Which single header should I add first?
Strict-Transport-Security, if you already serve everything over HTTPS. It closes the window where a user's first request travels unencrypted and can be intercepted.
Will Content-Security-Policy break my site?
It can, which is why report-only mode exists. Deploy it in report-only first, watch what it would have blocked, fix those, then enforce.
Is X-XSS-Protection still recommended?
No. Modern browsers have removed the feature, and it is not checked here. Content-Security-Policy is its replacement.
Do these headers affect SEO?
Not directly as ranking factors, but HTTPS is one, and a site that is compromised or serving mixed content will suffer badly. The headers protect against that.