如上图配置

add_header X-Content-Type-Options: nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header Content-Security-Policy "default-src 'self'";

如上图即成功

更多推荐

Nginx配置“Content-Security-Policy”头 、“X-XSS-Protection”头 和“X-Content-Type-Options”