Security headers instruct browsers how to treat your content. nginx injects them with add_header, but headers can be dropped or duplicated across nested location blocks—often you centralize snippets and use always so error pages receive the same policy. Start Content-Security-Policy in report-only mode, tighten gradually, and pair Strict-Transport-Security only when HTTPS is stable everywhere.
| Header | Role | Caveat |
|---|---|---|
| Strict-Transport-Security | Forces HTTPS for a duration | Long max-age is hard to unwind |
| Content-Security-Policy | Restricts scripts and loads | Breaks third-party embeds if too tight |
| Cross-Origin-Opener-Policy | Isolates browsing context | Can affect cross-window integrations |
Related
nginx SSL, nginx configuration, server blocks, Apache SSL (compare)