Configure Django production security settings

pinaxcon/settings.py

@@ -608,3 +608,20 @@ ACCOUNT_SIGNUP_REDIRECT_URL = '/dashboard/'
 ACCOUNT_LOGIN_REDIRECT_URL = '/dashboard/'
 
 ADMINS = [('', email) for email in os.environ.get('DJANGO_ADMINS', '').split(',') if email]
+
+# Django recommended security settings.
+SECURE_CONTENT_TYPE_NOSNIFF = True
+SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTOCOL', 'https')
+SECURE_SSL_REDIRECT = True
+SECURE_BROWSER_XSS_FILTER = True
+SESSION_COOKIE_SECURE = True
+CSRF_COOKIE_SECURE = True
+CSRF_COOKIE_HTTPONLY = True
+X_FRAME_OPTIONS = 'DENY'
+
+
+SILENCED_SYSTEM_CHECKS = [
+    # HSTS is handled by Nginx.
+    'security.W004',
+    # Don't want to preload HSTS at this stage.
+    'security.W021']