add_header Strict-Transport-Security max-age=63072000;
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection '1; mode=block';
#add_header Content-Security-Policy "default-src 'self';"; # Не включать