How to use 'Custom Nginx Configuration' function to modify headers for added security

Checklist

• Please read the setup instructions
  Done
• Please read the FAQ
  Done

What is troubling you?

In short, I am having some trouble using the Custom Nginx Configuration.

I just want to start by saying this is a great tool for noobs like me who are just getting into self-hosting and reverse proxy management. As a beginner, I am slightly paranoid about the security of my server and is chasing this elusive A+ header test (see https://securityheaders.com/) for the domain that I am hosting (I am currently getting an E grade with the default NPM with 'Block common exploits' enabled).

After some googling, I learnt that it will be useful to include the following NGINX configurations for added security

	add_header X-Xss-Protection "1; mode=block" always;
	add_header X-Content-Type-Options "nosniff" always;
	add_header Strict-Transport-Security "max-age=2592000; includeSubdomains" always;
	add_header X-Frame-Options "SAMEORIGIN" always;
	proxy_hide_header X-Powered-By;
	add_header 'Referrer-Policy' 'no-referrer';
	add_header Content-Security-Policy "frame-ancestors mydomain.com files.mydomain.com;";

The issue is when I dump them to Custom Nginx Configuration section of the GUI, nothing happens. If I try to add {} to the script, NPM will go offline.

	{add_header X-Xss-Protection "1; mode=block" always;
	add_header X-Content-Type-Options "nosniff" always;
	add_header Strict-Transport-Security "max-age=2592000; includeSubdomains" always;
	add_header X-Frame-Options "SAMEORIGIN" always;
	proxy_hide_header X-Powered-By;
	add_header 'Referrer-Policy' 'no-referrer';
	add_header Content-Security-Policy "frame-ancestors mydomain.com files.mydomain.com;";}

Can someone shed some light into how I could go about adding these headers?

Much appreciated.

Ed

Start with the Custom Nginx Configuration section in the GUI and compare its behavior with the NGINX directives and securityheaders.com result described in the issue. Review the linked setup instructions and FAQ first, then determine what documentation is missing about accepted syntax, configuration scope, and verifying the resulting headers.