Nginx security headers for WordPress headless setup

1. Enable Security Headers:
- Enable security headers in your Nginx configuration file. This can be done by adding the following lines to the `http` block:

nginx
     http {
         ...
         security_headers on;
         security_headers "Content-Security-Policy: default-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; frame-src 'self';";
         ...
     }
     

2. Set HTTP Headers:
- Set HTTP headers in your Nginx configuration file. This can be done by adding the following lines to the `http` block:

nginx
     http {
         ...
         add_header X-Frame-Options "SAMEORIGIN";
         add_header X-XSS-Protection "1; mode=block";
         add_header X-Content-Type-Options "nosniff";
         add_header Referrer-Policy "no-referrer";
         add_header Content-Security-Policy "default-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; frame-src 'self';";
         ...
     }
     

3. Configure Nginx:
- Configure Nginx to serve WordPress files. This can be done by adding the following lines to the `server` block:

nginx
     server {
         ...
         root /var/www/wordpress;
         index index.php index.html index.htm;
         server_name localhost;
         ...
     }
     

4. Configure WordPress:
- Configure WordPress to use the Nginx configuration. This can be done by adding the following lines to the `wp-config.php` file:

php
     define('WP_HOME', 'https://localhost');
     define('WP_SITEURL', 'https://localhost');
     

5. Test and Verify:
- Test and verify that the security headers are set correctly by checking the HTTP headers in your browser or using tools like `curl` or `wget`[1][2].

By following these steps, you can set security headers for a WordPress headless setup using Nginx, ensuring a more secure and robust configuration for your web application.