PHP.ini

 expose_php = Off

nginx security header - CSP

        # Add Security Headers

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

        add_header X-Content-Type-Options nosniff always;

        add_header X-Frame-Options "SAMEORIGIN" always;

        add_header X-XSS-Protection "1; mode=block" always;

        add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;

        # end