diff --git a/docs/example-advanced.nginx.conf b/docs/example-advanced.nginx.conf
index 0e74362dc..bb9638b61 100644
--- a/docs/example-advanced.nginx.conf
+++ b/docs/example-advanced.nginx.conf
@@ -92,15 +92,11 @@ server {
     # OnlyOffice fonts may be loaded from both domains
     if ($uri ~ ^/common/onlyoffice/.*/fonts/) { set $allowed_origins "*"; }
 
-    add_header X-XSS-Protection "1; mode=block";
     add_header X-Content-Type-Options nosniff;
     add_header Access-Control-Allow-Origin "${allowed_origins}";
     add_header Access-Control-Allow-Credentials true;
     # add_header X-Frame-Options "SAMEORIGIN";
 
-    # Opt out of Google's FLoC Network
-    add_header Permissions-Policy interest-cohort=();
-
     # Enable SharedArrayBuffer in Firefox (for .xlsx export)
     add_header Cross-Origin-Resource-Policy cross-origin;
     add_header Cross-Origin-Embedder-Policy require-corp;
@@ -185,9 +181,6 @@ server {
         set $scriptSrc "'self' 'unsafe-eval' 'unsafe-inline' resource: https://${main_domain}";
     }
 
-    # Finally, set all the rules you composed above.
-    add_header Content-Security-Policy "default-src 'none'; child-src $childSrc; worker-src $workerSrc; media-src $mediaSrc; style-src $styleSrc; script-src $scriptSrc; connect-src $connectSrc; font-src $fontSrc; img-src $imgSrc; frame-src $frameSrc; frame-ancestors $frameAncestors";
-
     # Add support for .mjs files used by pdfjs
     types {
         application/javascript mjs;
@@ -211,16 +204,78 @@ server {
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection upgrade;
+
+        # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
+
+        add_header X-Content-Type-Options nosniff;
+        add_header Access-Control-Allow-Origin "${allowed_origins}";
+        add_header Access-Control-Allow-Credentials true;
+        # add_header X-Frame-Options "SAMEORIGIN";
+
+        # Enable SharedArrayBuffer in Firefox (for .xlsx export)
+        add_header Cross-Origin-Resource-Policy cross-origin always;
+        add_header Cross-Origin-Embedder-Policy require-corp always;
+        add_header Referrer-Policy same-origin;
+
+        # Will not set any header if it is emptystring
+        add_header Cache-Control $cacheControl;
+
+        # Set all the rules you composed above.
+        add_header Content-Security-Policy "default-src 'none'; child-src $childSrc; worker-src $workerSrc; media-src $mediaSrc; style-src $styleSrc; script-src $scriptSrc; connect-src $connectSrc; font-src $fontSrc; img-src $imgSrc; frame-src $frameSrc; frame-ancestors $frameAncestors" always;
     }
 
     location ^~ /customize.dist/ {
         # This is needed in order to prevent infinite recursion between /customize/ and the root
+
+        if ($uri ~ ^/.*\.html) {
+            # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+            add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
+
+            add_header X-Content-Type-Options nosniff;
+            add_header Access-Control-Allow-Origin "${allowed_origins}";
+            add_header Access-Control-Allow-Credentials true;
+            # add_header X-Frame-Options "SAMEORIGIN";
+
+            # Enable SharedArrayBuffer in Firefox (for .xlsx export)
+            add_header Cross-Origin-Resource-Policy cross-origin always;
+            add_header Cross-Origin-Embedder-Policy require-corp always;
+            add_header Referrer-Policy same-origin;
+
+            # Will not set any header if it is emptystring
+            add_header Cache-Control $cacheControl;
+
+            # Set all the rules you composed above.
+            add_header Content-Security-Policy "default-src 'none'; child-src $childSrc; worker-src $workerSrc; media-src $mediaSrc; style-src $styleSrc; script-src $scriptSrc; connect-src $connectSrc; font-src $fontSrc; img-src $imgSrc; frame-src $frameSrc; frame-ancestors $frameAncestors" always;
+        }
     }
     # try to load customizeable content via /customize/ and fall back to the default content
     # located at /customize.dist/
     # This is what allows you to override behaviour.
     location ^~ /customize/ {
         rewrite ^/customize/(.*)$ $1 break;
+
+        if ($uri ~ ^/.*\.html) {
+            # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+            add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
+
+            add_header X-Content-Type-Options nosniff;
+            add_header Access-Control-Allow-Origin "${allowed_origins}";
+            add_header Access-Control-Allow-Credentials true;
+            # add_header X-Frame-Options "SAMEORIGIN";
+
+            # Enable SharedArrayBuffer in Firefox (for .xlsx export)
+            add_header Cross-Origin-Resource-Policy cross-origin always;
+            add_header Cross-Origin-Embedder-Policy require-corp always;
+            add_header Referrer-Policy same-origin;
+
+            # Will not set any header if it is emptystring
+            add_header Cache-Control $cacheControl;
+
+            # Set all the rules you composed above.
+            add_header Content-Security-Policy "default-src 'none'; child-src $childSrc; worker-src $workerSrc; media-src $mediaSrc; style-src $styleSrc; script-src $scriptSrc; connect-src $connectSrc; font-src $fontSrc; img-src $imgSrc; frame-src $frameSrc; frame-ancestors $frameAncestors" always;
+        }
+
         try_files /customize/$uri /customize.dist/$uri;
     }
 
@@ -299,8 +354,6 @@ server {
         # so we hide them
         proxy_hide_header 'X-Content-Type-Options';
         proxy_hide_header 'Access-Control-Allow-Origin';
-        proxy_hide_header 'Permissions-Policy';
-        proxy_hide_header 'X-XSS-Protection';
         proxy_hide_header 'Cross-Origin-Resource-Policy';
         proxy_hide_header 'Cross-Origin-Embedder-Policy';
         proxy_pass http://localhost:3000;
@@ -314,5 +367,30 @@ server {
     }
 
     # Finally, serve anything the above exceptions don't govern.
-    try_files /customize/www/$uri /customize/www/$uri/index.html /src/$uri /www/$uri /www/$uri/index.html /src/$uri /customize/$uri;
+    location ~* \.(css|js|mjs|png|svg|gif|ico|woff|woff2|eot|otf|ttf|cur|map)$ {
+        try_files /customize/www/$uri /customize/www/$uri/index.html /src/$uri /www/$uri /www/$uri/index.html /src/$uri /customize/$uri;
+    }
+
+    location / {
+        # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
+
+        add_header X-Content-Type-Options nosniff;
+        add_header Access-Control-Allow-Origin "${allowed_origins}";
+        add_header Access-Control-Allow-Credentials true;
+        # add_header X-Frame-Options "SAMEORIGIN";
+
+        # Enable SharedArrayBuffer in Firefox (for .xlsx export)
+        add_header Cross-Origin-Resource-Policy cross-origin always;
+        add_header Cross-Origin-Embedder-Policy require-corp always;
+        add_header Referrer-Policy same-origin;
+
+        # Will not set any header if it is emptystring
+        add_header Cache-Control $cacheControl;
+
+        # Set all the rules you composed above.
+        add_header Content-Security-Policy "default-src 'none'; child-src $childSrc; worker-src $workerSrc; media-src $mediaSrc; style-src $styleSrc; script-src $scriptSrc; connect-src $connectSrc; font-src $fontSrc; img-src $imgSrc; frame-src $frameSrc; frame-ancestors $frameAncestors" always;
+
+        try_files /customize/www/$uri /customize/www/$uri/index.html /src/$uri /www/$uri /www/$uri/index.html /src/$uri /customize/$uri;
+    }
 }
diff --git a/www/checkup/main.js b/www/checkup/main.js
index 9848a489a..29b9f1fee 100644
--- a/www/checkup/main.js
+++ b/www/checkup/main.js
@@ -448,38 +448,6 @@ define([
         });
     }
 
-    assert(function (cb, msg) {
-        setWarningClass(msg);
-
-        var printMessage = function (value) {
-            msg.appendChild(h('span', [
-                "This instance hasn't opted out of participation in Google's ",
-                code('FLoC'),
-                " targeted advertizing network. ",
-
-                "This can be done by setting a ",
-                code('permissions-policy'),
-                " HTTP header with a value of ",
-                code('"interest-cohort=()"'),
-                " in the configuration of its reverse proxy instead of the current value (",
-                code(value),
-                "). See the provided NGINX configuration file for an example. ",
-
-                h('p', [
-                    link("https://www.eff.org/deeplinks/2021/04/am-i-floced-launch", 'Learn more'),
-                ]),
-            ]));
-        };
-
-        Tools.common_xhr('/', function (xhr) {
-            var header = xhr.getResponseHeader('permissions-policy') || '';
-            var rules = header.split(',');
-            if (rules.includes('interest-cohort=()')) { return void cb(true); }
-            printMessage(JSON.stringify(header));
-            cb(header);
-        });
-    });
-
     assert(function (cb, msg) {
         msg.appendChild(h('span', [
             code('/api/broadcast'),