Ibuildings NelmioSecurityBundle recommended configuration

config.yml

nelmio_security:
    # don't use signed cookies
    # don't use encrypted cookies
    # prevent framing of the entire site
    clickjacking:
        paths:
            '^/.*': DENY
    # prevent redirections outside the website's domain
    external_redirects:
        abort: true
        log: true

    # prevents inline scripts, unsafe eval, external scripts/images/styles/frames, etc
    csp:
        report_uri: /nelmio/csp/report
        report_logger_service: monolog.logger.security
        default: [ self ]
        script:
            # JavaScript CDNs:
            - 'https://cdnjs.cloudflare.com'

    # disables content type sniffing for script resources
    content_type:
        nosniff: true

    # Force SSL (with HSTS), make sure SSL works before turning this on!
    #forced_ssl:
    #    hsts_max_age: 2592000 # 30 days
    #    hsts_subdomains: true

routing.yml

nelmio_security:
    path:     /nelmio/csp/report
    defaults: { _controller: nelmio_security.csp_reporter_controller:indexAction }
    methods:  [POST]

Note that I have not tried this, it will undoubtably need a lot of tweaking.
Also don't forget to turn on HSTS once you have TLS working.