diff --git a/include/security_headers_middleware.hpp b/include/security_headers_middleware.hpp
index 1ebc43c..83df24c 100644
--- a/include/security_headers_middleware.hpp
+++ b/include/security_headers_middleware.hpp
@@ -37,19 +37,23 @@
         res.addHeader(bf::pragma, "no-cache");
         res.addHeader(bf::cache_control, "no-Store,no-Cache");
 
-        // The KVM currently needs to load images from base64 encoded strings.
-        // img-src 'self' data: is used to allow that.
+        res.addHeader("Content-Security-Policy", "default-src 'none'; "
+                                                 "img-src 'self' data:; "
+                                                 "font-src 'self'; "
+                                                 "style-src 'self'; "
+                                                 "script-src 'self'; "
+                                                 "connect-src 'self' wss:");
+        // The KVM currently needs to load images from base64 encoded
+        // strings. img-src 'self' data: is used to allow that.
         // https://stackoverflow.com/questions/18447970/content-security-policy-data-not-working-for-base64-images-in-chrome-28
-        res.addHeader("Content-Security-Policy",
-                      "default-src 'self'; img-src 'self' data:");
+
         res.addHeader("X-XSS-Protection", "1; "
                                           "mode=block");
         res.addHeader("X-Content-Type-Options", "nosniff");
-        res.addHeader("X-UA-Compatible", "IE=11");
 
 #ifdef BMCWEB_INSECURE_DISABLE_XSS_PREVENTION
-
-        res.addHeader(bf::access_control_allow_origin, "http://localhost:8080");
+        res.addHeader(bf::access_control_allow_origin,
+                      req.getHeaderValue("Origin"));
         res.addHeader(bf::access_control_allow_methods, "GET, "
                                                         "POST, "
                                                         "PUT, "