updated security headers

1 files changed, 5 insertions, 2 deletions

diff --git a/lighttpd.conf b/lighttpd.conf
index 25ba938..da4ab07 100644
--- a/lighttpd.conf
+++ b/lighttpd.conf
@@ -30,8 +30,11 @@ $SERVER["socket"] == ":443" {
   ssl.ec-curve = "secp384r1"
   setenv.add-response-header = (
     "Strict-Transport-Security" => "max-age=31536000; includeSubdomains",
-    "X-Frame-Options" => "DENY",
-    "X-Content-Type-Options" => "nosniff"
+    "X-Frame-Options" => "SAMEORIGIN",
+    "X-XSS-Protection" => "1; mode=block",
+    "X-Content-Type-Options" => "nosniff",
+    "Referrer-Policy" => "no-referrer",
+    "Feature-Policy" =>  "geolocation none; midi none; notifications none; push none; sync-xhr none; microphone none; camera none; magnetometer none; gyroscope none; speaker none; vibrate none; fullscreen self; payment none; usb none;"
   )
 }