# About NC's "Security & Setup warnings" on ngninx

**URL:** <https://help.nextcloud.com/t/about-ncs-security-setup-warnings-on-ngninx/84535>\
**Category:** ℹ️ Support\
**Created:** [June 13, 2020, 3:59am UTC](https://help.nextcloud.com/t/about-ncs-security-setup-warnings-on-ngninx/84535 "2020-06-13T03:59:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zoo3](https://help.nextcloud.com/letter_avatar/zoo3/32/6_22734026db12803ebb3e059622ac3534.png) [@zoo3](https://help.nextcloud.com/u/zoo3)\
**Post date:** [June 13, 2020, 3:59am UTC](https://help.nextcloud.com/t/about-ncs-security-setup-warnings-on-ngninx/84535/1 "2020-06-13T03:59:35Z")

</div>

I’ve always wondered. I would describe nginx as follows.  
[https://docs.nextcloud.com/server/19/admin\_manual/installation/nginx.html](https://docs.nextcloud.com/server/19/admin_manual/installation/nginx.html)

I get a warning in NC if I have the following right after “server {”.

```
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;

```

> - The “X-Content-Type-Options” HTTP header is not set to “nosniff”. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
> - The “X-Robots-Tag” HTTP header is not set to “none”. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
> - The “X-Frame-Options” HTTP header is not set to “SAMEORIGIN”. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
> - The “X-Download-Options” HTTP header is not set to “noopen”. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
> - The “X-Permitted-Cross-Domain-Policies” HTTP header is not set to “none”. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.

However, [Nextcloud Security Scan](https://scan.nextcloud.com/) has an “A+” result.  
I remove it and it passes with “Security & Setup warnings”.  
\*That is to say, only in “location ~ .(?:css|js|woff2?|svg|gif|map)$”.

Which is correct, one written in two places and one written in one?  
Two places won’t pass in NC.

---

<div class="post-metadata">

**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\
**Post date:** [December 12, 2024, 7:20am UTC](https://help.nextcloud.com/t/about-ncs-security-setup-warnings-on-ngninx/84535/2 "2024-12-12T07:20:35Z")

</div>



---

<div class="post-metadata">

**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\
**Post date:** [December 12, 2024, 7:20am UTC](https://help.nextcloud.com/t/about-ncs-security-setup-warnings-on-ngninx/84535/3 "2024-12-12T07:20:36Z")

</div>