HSTS — stop plain HTTP entirely
Once a browser has seen this header, it refuses to use anything but https for your site. That closes the window an attacker on a shared network needs.
CSP — limit where scripts may come from
A content security policy decides which sources may execute code on your pages. It is the most effective of the five and the fussiest to configure — start with something like default-src 'self' and widen it as you find what breaks.
The other three, and the server banner
X-Frame-Options stops other sites from framing your pages, X-Content-Type-Options stops the browser guessing file types, and Referrer-Policy limits how much of the address travels with an outgoing click. Finally, a response that advertises your exact server version is what automated attacks look for, so it is worth hiding.