15th commit

Author: kevinThulnith

nginx.conf

@@ -12,6 +12,9 @@ http {
     keepalive_timeout  65;
     types_hash_max_size 2048;
 
+    # Rate limiting zone
+    limit_req_zone $binary_remote_addr zone=one:10m rate=5r/s;
+    
     # Gzip compression (enhanced)
     gzip on;
     gzip_vary on;
@@ -29,9 +32,12 @@ http {
         image/svg+xml;
 
     # Security headers
-    add_header X-Frame-Options DENY;
-    add_header X-Content-Type-Options nosniff;
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options "nosniff";
     add_header X-XSS-Protection "1; mode=block";
+    add_header Referrer-Policy "no-referrer-when-downgrade";
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';";
 
     server {
         listen       5173;
@@ -62,6 +68,7 @@ http {
 
         # Handle all other requests with SPA fallback
         location / {
+            limit_req zone=one burst=10 nodelay;
             try_files $uri $uri/ /index.html;
 
             # Don't cache the main index.html