nginx security header - CSP

        # Add Security Headers

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

        add_header X-Content-Type-Options nosniff always;

        add_header X-Frame-Options "SAMEORIGIN" always;

        add_header X-XSS-Protection "1; mode=block" always;

        add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Lax" always;

add_header Referrer-Policy "no-referrer-when-downgrade" always;

add_header Permissions-Policy "geolocation=(self), microphone=()";

add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';";

        # end

PHP.ini

 expose_php = Off