nginx.conf

add_header Referrer-Policy origin;

# skip nginx version number in error pages and Server header
server_tokens off;

add_header X-Download-Options noopen;
add_header X-Dns-Prefetch-Control off;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";

# enforce https
if ($http_x_forwarded_proto != "https") {
  return 301 https://$host$request_uri;
}

add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";

index index.php;

## only allow accessing the following php files
location ~ ^/(index|matomo|piwik|js/index).php {
    try_files @heroku-fcgi @heroku-fcgi;
}

## deny access to all other .php files
location ~* ^.+\.php$ {
    deny all;
    return 403;
}

## serve all other files normally 
location / {
    try_files $uri $uri/ =404;
}

## disable all access to the following directories 
location ~ /(config|tmp|core|lang) {
    deny all;
    return 403; # replace with 404 to not show these directories exist
}
location ~ /\.ht {
    deny  all;
    return 403;
}

location ~ \.(gif|ico|jpg|png|svg|js|css|htm|html|mp3|mp4|wav|ogg|avi|ttf|eot|woff|woff2|json)$ {
    allow all;
    ## Cache images,CSS,JS and webfonts for an hour
    ## Increasing the duration may improve the load-time, but may cause old files to show after an Matomo upgrade
    expires 1h;
    add_header Pragma public;
    add_header Cache-Control "public";
}

location ~ /(libs|vendor|plugins|misc/user) {
    deny all;
    return 403;
}

## properly display textfiles in root directory
location ~/(.*\.md|LEGALNOTICE|LICENSE) {
    default_type text/plain;
}