security-headers

Deploy CSP in report-only mode first using the Content-Security-Policy-Report-Only header, which logs violations without blocking resources. After two to four weeks of clean reports, switch to the enforcing Content-Security-Policy header.

Every site should set X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy, Strict-Transport-Security, and a Content-Security-Policy. Adding Permissions-Policy and cross-origin isolation headers further reduces browser attack surface.

Use the add_header directive in your server block with the always flag so headers apply to error responses too. Set server_tokens off to hide version information, and phase HSTS max-age from short values up to one year.

Yes, generate a per-request cryptographic nonce and include it in script-src and style-src directives, then apply the same nonce to inline tags. This blocks injected scripts while allowing your own inline code, unlike unsafe-inline which defeats XSS protection.

The includeSubDomains directive forces HTTPS on all subdomains, so any subdomain still serving HTTP becomes unreachable. Only enable it after confirming every subdomain supports HTTPS, and start with a short max-age during rollout.

Write automated tests that fetch your staging URL and assert the presence and values of key headers like CSP, HSTS, and X-Frame-Options. Tools like curl, httpx with pytest, and Mozilla Observatory's API can validate configurations on every deploy.