Setting headers

[Paul]

I'm looking for some advice.  Using nginx/1.18.0 (Ubuntu) in production 
(~400k+ connections/day) across multiple domains (some nginx => 
apache2), I am considering for top-level server block the following:

add_header X-XSS-Protection "1; mode=block" always;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options nosniff;
add_header 'Referrer-Policy' 'origin';

I have no other "header' directives except for multiple "proxy_set_header"

Are there any pitfalls or caveats?  And is the code above correct as I 
have noticed double quotes, single quotes and nosniff not quoted?

Thanks in advance,
Paul