Create Security Headers.

Strict-Transport-Security

max-age=31536000

Content-Security-Policy

frame-ancestors 'self'

X-Frame-Options

SAMEORIGIN

X-Content-Type-Options

nosniff

Referrer-Policy

strict-origin-when-cross-origin

Permissions-Policy

camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()

Cross-Origin-Opener-Policy

same-origin-allow-popups

• Note: Without a Content Security Policy of your own, the most important protection against cross-site scripting is missing. A CSP must match your scripts: create it specifically, test it as Report-Only first and then paste it into the “Content-Security-Policy” field.

Configuration

# nginx: in the server block (or location block)
# always: also send with error pages and redirects
add_header Strict-Transport-Security "max-age=31536000" always;
add_header Content-Security-Policy "frame-ancestors 'self'" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()" always;
add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;

# Hide version information
server_tokens off;
fastcgi_hide_header X-Powered-By;   # with PHP-FPM
proxy_hide_header X-Powered-By;     # with a reverse proxy

• The Content Security Policy only contains frame-ancestors. If your website already sets a CSP, both apply side by side; better add frame-ancestors to the existing policy (“Content-Security-Policy” field above).
• add_header in a location block cancels all inherited add_header lines (nginx documentation). Therefore copy the lines into every block with its own add_header lines.
• server_tokens off removes the version number, not the word nginx. X-Powered-By is usually set by the application behind it (PHP-FPM, proxy); use whichever of the two hide_header lines fits your setup.