diff --git a/mailserver/nginx/default.nix b/mailserver/nginx/default.nix
index bb061a6..40a517d 100644
--- a/mailserver/nginx/default.nix
+++ b/mailserver/nginx/default.nix
@@ -3,9 +3,22 @@
   services = {
     nginx = {
       enable = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
-      virtualHosts."webshite.idimitrov.dev" = {
+      sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
+      appendHttpConfig = ''
+        map $scheme $hsts_header {
+            https   "max-age=31536000; includeSubdomains; preload";
+        }
+        add_header Strict-Transport-Security $hsts_header;
+        add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
+        add_header 'Referrer-Policy' 'origin-when-cross-origin';
+        add_header X-Frame-Options DENY;
+        add_header X-Content-Type-Options nosniff;
+      '';
+      virtualHosts."idimitrov.dev" = {
         enableACME = true;
         forceSSL = true;
         locations."/" = {