diff --git a/src/base/http/types.h b/src/base/http/types.h
index ae401c719..a8dc9a898 100644
--- a/src/base/http/types.h
+++ b/src/base/http/types.h
@@ -44,6 +44,9 @@ namespace Http
     const QString HEADER_CONTENT_LENGTH = "Content-Length";
     const QString HEADER_CACHE_CONTROL = "Cache-Control";
     const QString HEADER_X_FRAME_OPTIONS = "X-Frame-Options";
+    const QString HEADER_X_XSS_PROTECTION = "X-XSS-Protection";
+    const QString HEADER_X_CONTENT_TYPE_OPTIONS = "X-Content-Type-Options";
+    const QString HEADER_CONTENT_SECURITY_POLICY = "Content-Security-Policy";
 
     const QString CONTENT_TYPE_CSS = "text/css; charset=UTF-8";
     const QString CONTENT_TYPE_GIF = "image/gif";
diff --git a/src/webui/abstractwebapplication.cpp b/src/webui/abstractwebapplication.cpp
index 7a587ae44..ce3dedb19 100644
--- a/src/webui/abstractwebapplication.cpp
+++ b/src/webui/abstractwebapplication.cpp
@@ -106,6 +106,9 @@ Http::Response AbstractWebApplication::processRequest(const Http::Request &reque
 
     // avoid clickjacking attacks
     header(Http::HEADER_X_FRAME_OPTIONS, "SAMEORIGIN");
+    header(Http::HEADER_X_XSS_PROTECTION, "1; mode=block");
+    header(Http::HEADER_X_CONTENT_TYPE_OPTIONS, "nosniff");
+    header(Http::HEADER_CONTENT_SECURITY_POLICY, "default-src 'self' 'unsafe-inline' 'unsafe-eval';");
 
     sessionInitialize();
     if (!sessionActive() && !isAuthNeeded())