Configure Essential Security HTTP Headers in Nginx

# Add these directives inside your 'server' block or 'location' block

# HTTP Strict Transport Security (HSTS) - Enforce HTTPS
# max-age: how long the browser should remember to only access the site using HTTPS
# includeSubDomains: applies HSTS to all subdomains
# preload: opt-in to include your domain in browser's HSTS preload list (requires submission)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# X-Frame-Options - Prevent Clickjacking attacks
# DENY: page cannot be displayed in a frame
# SAMEORIGIN: page can only be displayed in a frame on the same origin as the page itself
add_header X-Frame-Options "SAMEORIGIN" always;

# X-Content-Type-Options - Prevent MIME-type sniffing
# nosniff: prevents browsers from trying to guess ("sniff") the content type, mitigating XSS
add_header X-Content-Type-Options "nosniff" always;

# X-XSS-Protection - Enable built-in browser XSS filter (deprecated, CSP is preferred)
# Still useful for older browsers that don't support CSP fully.
# "1; mode=block": enables XSS filter, blocks entire page if XSS attack detected
add_header X-XSS-Protection "1; mode=block" always;

# Referrer-Policy - Control how much referrer information is sent
# no-referrer-when-downgrade: Send referrer for same-origin, but not cross-origin HTTPS to HTTP
add_header Referrer-Policy "no-referrer-when-downgrade" always;

# Content Security Policy (CSP) - Most powerful XSS mitigation
# This is a complex header, this is a basic example.
# default-src 'self': Only allow resources from the same origin.
# script-src 'self' 'unsafe-inline' 'unsafe-eval' (unsafe options should be avoided if possible and replaced with nonces/hashes)
# In a real application, replace 'unsafe-inline' and 'unsafe-eval' with specific sources or hashes/nonces.
add_header Content-Security-Policy "default-src 'self';
                                            script-src 'self';
                                            style-src 'self' 'unsafe-inline';
                                            img-src 'self' data:;
                                            font-src 'self';
                                            connect-src 'self';" always;