nginx.conf

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
add_header X-Content-Type-Options "nosniff";
add_header Content-Security-Policy "object-src 'none'; frame-ancestors 'none'; form-action 'none'; base-uri 'none'; style-src 'sha256-AXbH1M2cKtoww1nExN6V4uFCB0/4cBXXoftPGP70hjk='; script-src 'sha256-AfHB/yZdM1LiSJzDQKv0mdzXeQMZGsWQiTxLhsdPkOk=' 'self'";
add_header Cache-Control "public";

if ($host ~ ^www\.(?<domain>.+)$) {
  return 301 $scheme:https://$domain$request_uri;
}

location = / {
  if ($http_accept_language ~* 'ru') {
    rewrite (.*) https://$http_host/ru$1 last;
  }
  if ($http_accept_language ~* 'es') {
    rewrite (.*) https://$http_host/es$1 last;
  }
  rewrite (.*) https://$http_host/en$1 last;
}

if (-d $request_filename) {
  rewrite [^/]$ https://$http_host$uri/ permanent;
}

location ~* "(photo\..*\.jpg|\.js|\.png|\.webp|\.avif)$" {
  add_header X-Content-Type-Options "nosniff";
  add_header Cache-Control "public, max-age=31536000, immutable";
}

location ~* "(\.jpg|\.png|\.webp|\.ico|\.avif)$" {
  add_header Content-Security-Policy "";
}