diff --git a/ncac/package/cac.conf b/ncac/package/cac.conf
index 45bfa3c..274e7cb 100644
--- a/ncac/package/cac.conf
+++ b/ncac/package/cac.conf
@@ -1,6 +1,11 @@
 server {
     listen       80;
     server_name  cacserver;
+    # 安全头配置
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self'; frame-ancestors 'none';" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "upgrade";