+ add_header X-XSS-Protection "1; mode=block";
+ add_header X-Permitted-Cross-Domain-Policies none;
+ add_header X-Frame-Options DENY;
+ add_header X-Content-Type-Options nosniff;
+ add_header Referrer-Policy same-origin;
+ add_header X-Download-Options noopen;
+
+ # Uncomment this only after you get HTTPS working.
+ # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
+