diff --git a/include/cors_preflight.hpp b/include/cors_preflight.hpp
index 0a5c3cc..844fd38 100644
--- a/include/cors_preflight.hpp
+++ b/include/cors_preflight.hpp
@@ -10,7 +10,7 @@
 {
     BMCWEB_ROUTE(app, "<str>")
         .methods(boost::beast::http::verb::options)(
-            [](const crow::Request& req, crow::Response& res) {
+            [](const crow::Request&, crow::Response& res, const std::string&) {
                 // An empty body handler that simply returns the headers bmcweb
                 // uses This allows browsers to do their CORS preflight checks
                 res.end();
diff --git a/include/security_headers.hpp b/include/security_headers.hpp
index 13ec893..e3c472e 100644
--- a/include/security_headers.hpp
+++ b/include/security_headers.hpp
@@ -2,7 +2,8 @@
 
 #include <http_response.hpp>
 
-inline void addSecurityHeaders(crow::Response& res)
+inline void addSecurityHeaders(const crow::Request& req [[maybe_unused]],
+                               crow::Response& res)
 {
     /*
      TODO(ed) these should really check content types.  for example,
@@ -22,40 +23,41 @@
                                       "mode=block");
     res.addHeader("X-Content-Type-Options", "nosniff");
 
-#ifndef BMCWEB_INSECURE_DISABLE_XSS_PREVENTION
-    res.addHeader("Content-Security-Policy", "default-src 'none'; "
-                                             "img-src 'self' data:; "
-                                             "font-src 'self'; "
-                                             "style-src 'self'; "
-                                             "script-src 'self'; "
-                                             "connect-src 'self' wss:");
-    // The KVM currently needs to load images from base64 encoded
-    // strings. img-src 'self' data: is used to allow that.
-    // https://stackoverflow.com/questions/18447970/content-security-policy-data-not-working-for-base64-images-in-chrome-28
+    if (bmcwebInsecureDisableXssPrevention)
+    {
+        res.addHeader("Content-Security-Policy", "default-src 'none'; "
+                                                 "img-src 'self' data:; "
+                                                 "font-src 'self'; "
+                                                 "style-src 'self'; "
+                                                 "script-src 'self'; "
+                                                 "connect-src 'self' wss:");
+        // The KVM currently needs to load images from base64 encoded
+        // strings. img-src 'self' data: is used to allow that.
+        // https://stackoverflow.com/questions/18447970/content-security-policy-data-not-working-for-base64-images-in-chrome-28
+    }
+    else
+    {
+        // If XSS is disabled, we need to allow loading from addresses other
+        // than self, as the BMC will be hosted elsewhere.
+        res.addHeader("Content-Security-Policy", "default-src 'none'; "
+                                                 "img-src *; "
+                                                 "font-src *; "
+                                                 "style-src *; "
+                                                 "script-src *; "
+                                                 "connect-src *");
 
-#else
-    // If XSS is disabled, we need to allow loading from addresses other
-    // than self, as the BMC will be hosted elsewhere.
-    res.addHeader("Content-Security-Policy", "default-src 'none'; "
-                                             "img-src *; "
-                                             "font-src *; "
-                                             "style-src *; "
-                                             "script-src *; "
-                                             "connect-src *");
-
-    const std::string_view origin = req.getHeaderValue("Origin");
-    res.addHeader(bf::access_control_allow_origin, origin);
-    res.addHeader(bf::access_control_allow_methods, "GET, "
-                                                    "POST, "
-                                                    "PUT, "
-                                                    "PATCH, "
-                                                    "DELETE");
-    res.addHeader(bf::access_control_allow_credentials, "true");
-    res.addHeader(bf::access_control_allow_headers, "Origin, "
-                                                    "Content-Type, "
-                                                    "Accept, "
-                                                    "Cookie, "
-                                                    "X-XSRF-TOKEN");
-
-#endif
+        const std::string_view origin = req.getHeaderValue("Origin");
+        res.addHeader(bf::access_control_allow_origin, origin);
+        res.addHeader(bf::access_control_allow_methods, "GET, "
+                                                        "POST, "
+                                                        "PUT, "
+                                                        "PATCH, "
+                                                        "DELETE");
+        res.addHeader(bf::access_control_allow_credentials, "true");
+        res.addHeader(bf::access_control_allow_headers, "Origin, "
+                                                        "Content-Type, "
+                                                        "Accept, "
+                                                        "Cookie, "
+                                                        "X-XSRF-TOKEN");
+    }
 }