add_header Referrer-Policy same-origin always;
add_header X-Content-Type-Options nosniff always;
add_header X-Frame-Options sameorigin always;
add_header X-XSS-Protection "1; mode=block" always;
proxy_hide_header Referrer-Policy;
proxy_hide_header X-Content-Type-Options;
proxy_hide_header X-Frame-Options;
proxy_hide_header X-XSS-Protection;