# 检测到目标 X-Content-Type-Options响应头缺失 这个暂时不开启,不然部分banner无法使用
#add_header X-Content-Type-Options "nosniff";
# 检测到目标 X-XSS-Protection响应头缺失
add_header X-XSS-Protection "1; mode=block";
# 检测到目标 Content-Security-Policy响应头缺失
add_header Content-Security-Policy "default-src 'self' http: https://* data: blob: 'unsafe-eval' 'unsafe-inline';child-src 'none' " always;
# 检测到目标 Referrer-Policy响应头缺失
add_header Referrer-Policy "no-referrer-when-downgrade" always;
# 检测到目标 X-Permitted-Cross-Domain-Policies响应头缺失
add_header X-Permitted-Cross-Domain-Policies none;
# 检测到目标 X-Download-Options响应头缺失
add_header X-Download-Options noopen;
# 检测到目标 Strict-Transport-Security响应头缺失
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
Nginx 低风险漏洞更新
于 2023-12-18 16:25:59 首次发布