add X-Frame-Options specifically

util/Nginx/security-headers.conf

@@ -1,4 +1,3 @@
 add_header Referrer-Policy same-origin;
-add_header X-Frame-Options SAMEORIGIN;
 add_header X-Content-Type-Options nosniff;
 add_header X-XSS-Protection "1; mode=block";

util/Setup/Templates/NginxConfig.hbs

@@ -55,6 +55,7 @@ server {
 {{/if}}
     include /etc/nginx/security-headers.conf;
     add_header Content-Security-Policy "{{{ContentSecurityPolicy}}}";
+    add_header X-Frame-Options SAMEORIGIN;
   }
 
   location = /app-id.json {
@@ -103,5 +104,10 @@ server {
 
   location /admin {
     proxy_pass http://admin:5000;
+{{#if Ssl}}
+    include /etc/nginx/security-headers-ssl.conf;
+{{/if}}
+    include /etc/nginx/security-headers.conf;
+    add_header X-Frame-Options SAMEORIGIN;
   }
 }