add_header "X-Xss-Protection" "1; mode=block" always;
add_header "X-Frame-Options" "SAMEORIGIN" always;
add_header "X-Content-Type-Options" "nosniff" always;
add_header "Referrer-Policy" "no-referrer-when-downgrade" always;
