X-XSS Protection in VestaCP

Edit /etc/nginx/conf.d/nginx.conf

Add

add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";

Save and reload nginx

service nginx restart

Check Nginx header

curl -I domain.com