diff --git a/include/security_headers.hpp b/include/security_headers.hpp
index e3c472e..e8cd37a 100644
--- a/include/security_headers.hpp
+++ b/include/security_headers.hpp
@@ -23,7 +23,7 @@
                                       "mode=block");
     res.addHeader("X-Content-Type-Options", "nosniff");
 
-    if (bmcwebInsecureDisableXssPrevention)
+    if (!bmcwebInsecureDisableXssPrevention)
     {
         res.addHeader("Content-Security-Policy", "default-src 'none'; "
                                                  "img-src 'self' data:; "