diff --git a/conf/nginx.conf b/conf/nginx.conf
index 61ab5ba..c21f625 100644
--- a/conf/nginx.conf
+++ b/conf/nginx.conf
@@ -1,10 +1,61 @@
 location / {
+	if ($args ~ ver=) {
+        set $cacheControl max-age=31536000;
+        }
+        # Will not set any header if it is emptystring
+        add_header Cache-Control $cacheControl;
+	
+	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        add_header X-XSS-Protection "1; mode=block";
+        add_header X-Content-Type-Options nosniff;
+        # add_header X-Frame-Options "SAMEORIGIN";
 	if ($scheme = http) {
 		rewrite ^ https://$server_name$request_uri? permanent;
 	}
-	proxy_pass             http://localhost:__PORT__/;
-	proxy_set_header       Host $host;
-	proxy_buffering off;
+		
+	set $styleSrc   "'unsafe-inline' 'self'";
+        set $scriptSrc  "'self'";
+        set $connectSrc "'self' wss://cryptpad.fr wss://api.cryptpad.fr";
+        set $fontSrc    "'self'";
+        set $imgSrc     "data: *";
+        set $frameSrc   "'self' beta.cryptpad.fr";
+
+        if ($uri = /pad/inner.html) {
+           set $scriptSrc "'self' 'unsafe-eval' 'unsafe-inline'";
+        }
+        add_header Content-Security-Policy "default-src 'none'; style-src $styleSrc; script-src $scriptSrc; connect-src $connectSrc; font-src $fontSrc; img-src $imgSrc; frame-src $frameSrc;";
+
+        location = /cryptpad_websocket {
+        proxy_pass    http://localhost:__PORT__/;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+#       add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        # WebSocket support (nginx 1.4)
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection upgrade;
+        }
+
+        location ^~ /customize.dist/ {
+           # This is needed in order to prevent infinite recursion between /customize/ and the root
+         }
+        location ^~ /customize/ {
+            rewrite ^/customize/(.*)$ $1 break;
+            try_files /customize/$uri /customize.dist/$uri;
+        }
+        location = /api/config {
+            default_type text/javascript;
+            rewrite ^.*$ /customize/api/config break;
+        }
+
+        ## TODO fix in the code so that we don't need this
+        location ~ ^/(register|login|settings|user|pad|drive|poll|slide|code|whiteboard)$ {
+            rewrite ^(.*)$ $1/ redirect;
+        }
+
+        try_files /www/$uri /www/$uri/index.html /customize/$uri;
 
 	# Include SSOWAT user panel.
 	include conf.d/yunohost_panel.conf.inc;