When an unauthenticated injection triggered a 2 AM emergency, missing HTTP headers left customer browsers wide open. Here is how to configure Content Security Policy (CSP), X-Frame-Options, and HSTS directly in Nginx to block XSS and clickjacking.