diff --git a/deployment/docker/nginx.conf b/deployment/docker/nginx.conf
index 98f95f7e7..376abbdab 100644
--- a/deployment/docker/nginx.conf
+++ b/deployment/docker/nginx.conf
@@ -22,9 +22,11 @@ http {
 
 	include /etc/nginx/mime.types;
 	default_type application/octet-stream;
+	add_header X-Content-Type-Options nosniff;
 
 	access_log /var/log/nginx/access.log private;
 	error_log /var/log/nginx/error.log;
+	add_header Referrer-Policy same-origin
 
 	gzip on;
 	gzip_disable "msie6";
diff --git a/doc/admin/installation/manual_smallscale.rst b/doc/admin/installation/manual_smallscale.rst
index 1361963c2..744fc3be3 100644
--- a/doc/admin/installation/manual_smallscale.rst
+++ b/doc/admin/installation/manual_smallscale.rst
@@ -213,6 +213,9 @@ The following snippet is an example on how to configure a nginx proxy for pretix
         ssl_certificate /path/to/cert.chain.pem;
         ssl_certificate_key /path/to/key.pem;
 
+        add_header Referrer-Options same-origin;
+        add_header X-Content-Type-Options nosniff;
+
         location / {
             proxy_pass http://localhost:8345/;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;