How to add security headers to your website

Security headers are instructions the server sends to the browser to block common attacks. They are added in a few lines.

Nginx

In the server block, add:

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

nginx -t && systemctl reload nginx

What these headers do

• X-Frame-Options: prevents the site from loading in an iframe (anti-clickjacking protection).
• X-Content-Type-Options: stops the browser from guessing file types.
• Referrer-Policy: controls what referrer information is sent to other sites.
• Strict-Transport-Security: forces HTTPS for future visits.

Content Security Policy

For advanced protection against injected scripts, add a CSP header, but test it carefully so you do not block legitimate resources:

add_header Content-Security-Policy "default-src 'self'" always;

Check the result with free online header-analysis tools. See also how to add HTTPS.