NGINX basic security headers

nginx.conf

add_header Content-Security-Policy "upgrade-insecure-requests" always;
add_header Feature-Policy "accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'self'; camera 'none'; encrypted-media 'self'; fullscreen 'self'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'self'; midi 'none'; payment 'self'; picture-in-picture 'self'; speaker 'self'; sync-xhr 'self'; usb 'none'; vr 'none'" always;
add_header Permissions-Policy "accelerometer=(none), ambient-light-sensor=(none), autoplay=(self), camera=(none), encrypted-media=(self), fullscreen=(self), geolocation=(none), gyroscope=(none), magnetometer=(none), microphone=(self), midi=(none), payment=(self), picture-in-picture=(self), speaker=(self), sync-xhr=(self), usb=(none), vr=(none), interest-cohort=()" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Xss-Protection "1; mode=block" always;