server_tokens off;

add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";

more_clear_headers 'X-Powered-By';
more_clear_headers 'Server';