Okay, nvm. Security checks work even with the proxy. It turns out Nextcloud is just picky with some of the fields. For example, I had set X-Robots-Tag to SWAG’s recommended default of noindex, nofollow, nosnippet, noarchive, but Nextcloud expects only noindex, nofollow.