location / {
  add_header X-Frame-Options "DENY" always;
}