anchor.diff:    ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
     ssl_session_cache shared:SSL:10m;
     ssl_session_tickets off; # Requires nginx >= 1.5.9
  +  resolver 8.8.8.8 8.8.4.4;
     ssl_stapling on; # Requires nginx >= 1.3.7
     ssl_stapling_verify on; # Requires nginx => 1.3.7
   
  
positive.code:   }
  
    listen 443 ssl http2;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1; #Turns off TLSv3 to protect against POODLE Attack
    ssl on;
    ssl_prefer_server_ciphers on; # Force server to use ciphers or it will default to browser settings
  
negative.code: fastcgi_cache_path <%= @web_root %>/cache levels=1:2 keys_zone=<%= @app_name %>:100m inactive=60m;
  
  add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
  
  add_header X-Frame-Options SAMEORIGIN;
  
  add_header X-Content-Type-Options nosniff;
  
  add_header X-XSS-Protection "1; mode=block";
  
  add_header Referrer-Policy "origin"
  
  add_header Content-Security-Policy "default-src 'self' 'unsafe-inline'  https:; font-src https: data:";
  
  server {
    listen 80;
    listen [::]:80;
  