diff --git a/resources/core/nginx/nginx-template.conf b/resources/core/nginx/nginx-template.conf
index 2e23f5fd..8aaf0782 100644
--- a/resources/core/nginx/nginx-template.conf
+++ b/resources/core/nginx/nginx-template.conf
@@ -21,11 +21,11 @@ server {
 	proxy_buffers 4 256k;
 	proxy_busy_buffers_size 256k;
 
-	add_header X-Frame-Options "SAMEORIGIN";
-	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
-	add_header X-Content-Type-Options nosniff;
-	add_header X-XSS-Protection "1; mode=block";
-	add_header Referrer-Policy "same-origin, strict-origin-when-cross-origin";
+	add_header X-Frame-Options "SAMEORIGIN" always;
+	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+	add_header X-Content-Type-Options nosniff always;
+	add_header X-XSS-Protection "1; mode=block" always;
+	add_header Referrer-Policy "same-origin, strict-origin-when-cross-origin" always;
 
 	set_real_ip_from ${UPSTREAM_REAL_IP_ADDRESS};
 	real_ip_header ${UPSTREAM_REAL_IP_HEADER};
@@ -59,6 +59,11 @@ server {
 		rewrite ^(.+)\.html$ $1 permanent;
 
 		location ~ ^/files/.*.(htm|html|svg|xml) {
+			add_header X-Frame-Options "SAMEORIGIN" always;
+			add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+			add_header X-Content-Type-Options nosniff always;
+			add_header X-XSS-Protection "1; mode=block" always;
+			add_header Referrer-Policy "same-origin, strict-origin-when-cross-origin" always;
 			add_header Content-disposition "attachment";
 			try_files /${FRAPPE_SITE_NAME_HEADER}/public/$uri @webserver;
 		}