Error adding http security headers

I also had a couple more questions if you could hopefully help with them. Ive tried all sorts of rewrite rules but no matter what I try I cant get sitemap to show up always get 404.

Also I'm trying to run lazulu.com with cloudfront but not having much luck. Haven't found much info on it either.. Best I found really was the below "subs_filter" but they aren't actually doing anything. ---I really want to set it up without using a plugin.
Thanks alot for any help you can provide.

server {

server_name lazulu.com   www.lazulu.com;


access_log /var/log/nginx/lazulu.com.access.log rt_cache_redis;
error_log /var/log/nginx/lazulu.com.error.log;


root /var/www/lazulu.com/htdocs;



index index.php index.html index.htm;


include  common/redis-php7.conf;

include common/wpcommon-php7.conf;
include common/locations-php7.conf;
include /var/www/lazulu.com/conf/nginx/*.conf;

}

    subs_filter //lazulu.com/wp-content/ //d3db9hry2u29mh.cloudfront.net/wp-content/;
    subs_filter //lazulu.com/wp-includes/ //d3db9hry2u29mh.cloudfront.net/wp-includes/;
    subs_filter \/\/lazulu.com\/wp-content\/ \/\/d3db9hry2u29mh.cloudfront.net\/wp-content\/;
    subs_filter \/\/lazulu.com\/wp-includes\/ \/\/d3db9hry2u29mh.cloudfront.net\/wp-includes\/;

server {

server_name resistfromday1.org   www.resistfromday1.org;


access_log /var/log/nginx/resistfromday1.org.access.log rt_cache_redis;
error_log /var/log/nginx/resistfromday1.org.error.log;


root /var/www/resistfromday1.org/htdocs;



index index.php index.html index.htm;


include  common/redis-php7.conf;

include common/wpcommon-php7.conf;
include common/locations-php7.conf;
include /var/www/resistfromday1.org/conf/nginx/*.conf;

}