diff --git a/configs/nginx/nginx.example b/configs/nginx/nginx.example index a8d15061..ae6f24ac 100644 --- a/configs/nginx/nginx.example +++ b/configs/nginx/nginx.example @@ -10,7 +10,7 @@ server { add_header Cache-Control "public"; add_header Content-Security-Policy "default-src 'self'; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube.com/embed/ https://www.bitchute.com/embed/"; - add_header Referrer-Policy "same-origin strict-origin-when-cross-origin" always; + add_header Referrer-Policy "same-origin, strict-origin-when-cross-origin" always; add_header X-Frame-Options "sameorigin" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; diff --git a/configs/nginx/nginx_no_https.example b/configs/nginx/nginx_no_https.example index 6afc7f04..2cf03062 100644 --- a/configs/nginx/nginx_no_https.example +++ b/configs/nginx/nginx_no_https.example @@ -10,7 +10,7 @@ server { add_header Cache-Control "public"; add_header Content-Security-Policy "default-src 'self'; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube.com/embed/ https://www.bitchute.com/embed/"; - add_header Referrer-Policy "same-origin strict-origin-when-cross-origin" always; + add_header Referrer-Policy "same-origin, strict-origin-when-cross-origin" always; add_header X-Frame-Options "sameorigin" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; diff --git a/configs/nginx/snippets/security_headers.conf b/configs/nginx/snippets/security_headers.conf index 692427a5..767150aa 100644 --- a/configs/nginx/snippets/security_headers.conf +++ b/configs/nginx/snippets/security_headers.conf @@ -1,6 +1,6 @@ add_header Cache-Control "public"; add_header Content-Security-Policy "default-src 'self'; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube.com/embed/ https://www.bitchute.com/embed/"; -add_header Referrer-Policy "same-origin strict-origin-when-cross-origin" always; +add_header Referrer-Policy "same-origin, strict-origin-when-cross-origin" always; add_header X-Frame-Options "sameorigin" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always;