add_header Content-Security-Policy upgrade-insecure-requests; add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff";