Think of these headers not so much as security. Just because a site doesn't have this or other headers doesn't make it any less secure. The headers are better d

Think of these headers not so much as security. Just because a site doesn't have this or other headers doesn't make it any less secure. The headers are better described as fine-tuned access-control policies. You want to be able to send your users notifications on your site? Well great, now any ads on your site have the same ability. These headers allow you to control that. The primary site has features x,y, and z - but any ads or iframes don't have any features. > distributing untrustworthy and insecure code. So this isn't really how things are, we didn't have the ability to fine-tune these access control features before. Either you accepted a website as a whole to give you notifications or not. On the client side it still appears the same, but on the server side they can limit which scripts/domains actually get those permissions.