To stop individuals from using bookmarklets to load a client from a distinct URL onto your Formal URL through XXS, include these headers to NGINX: It is possible to test darverdevs's plugin installer In this article which can automatically install These types of plugins so that you can help save time Remember to read through LAX1DUDE_SIGN