most likely the issue is related to hostname you use to access your Nextcloud. As you get right results without www. prefix and worse result with prefix and test clearly states __host-Prefix cookies are missing… the issue must be related to your redirection from micloud.ddns.info to www.micloud.ddns.info. Most likely Nextcloud is configured for micloud.ddns.info and is not avare of www. Strictrly speaking both websites are not the same so cookie your system places on the client are wrong which is the reason you get bad security rating.
You can inspect the cookie your server places on the client using “F12” browser dev tools. Here screenshot from Firefox - double check domain of the cookie matches the address you access.
try adopting you Nextcloud root according the reverse proxy guide. I assume
’overwritehost’ => ‘www.micloud.ddns.info’,
will do the trick. The other security headers are present when you access using right URL - most likely it works once you adopt the overwritehost directive in the config.php.
UPDATE: Another user mentioned new nginx template - take a look if it helps as well Unavoidable security & setup warnings with NC 21 update - #56 by nursoda