--- a/provision/roles/fruitbar/templates/etc/nginx/sites-available/fruitbar	Wed Mar 02 21:42:54 2016 +0800
+++ b/provision/roles/fruitbar/templates/etc/nginx/sites-available/fruitbar	Wed Apr 06 13:06:28 2016 +0800
@@ -40,15 +40,15 @@
     resolver 8.8.8.8 [2001:4860:4860::8888] 8.8.4.4 [2001:4860:4860::8844];
     resolver_timeout 5s;
 
-    # access from <frame | iframe | object>: DENY | SAMEORIGIN | ALLOW-FROM uri
-    add_header X-Frame-Options 'SAMEORIGIN';
-
     # HSTS: 31536000 = 365 days (set to 0 to expire and allow plain HTTP)
     add_header Strict-Transport-Security 'max-age=31536000';
 
     add_header Cache-Control private;
 {% endif %}
 
+    # access from <frame | iframe | object>: DENY | SAMEORIGIN | ALLOW-FROM uri
+    add_header X-Frame-Options 'SAMEORIGIN';
+
     access_log /var/log/nginx/fruitbar.{{ umbrella }}.access.log;
     error_log /var/log/nginx/fruitbar.{{ umbrella }}.error.log;