diff --git a/module/obmc/wsgi/apps/rest_dbus.py b/module/obmc/wsgi/apps/rest_dbus.py
index f172cdc..cda23df 100644
--- a/module/obmc/wsgi/apps/rest_dbus.py
+++ b/module/obmc/wsgi/apps/rest_dbus.py
@@ -966,6 +966,14 @@
             response.add_header('Access-Control-Allow-Methods', method)
             response.add_header(
                 'Access-Control-Allow-Headers', 'Content-Type')
+            response.add_header('X-Frame-Options', 'deny')
+            response.add_header('X-Content-Type-Options', 'nosniff')
+            response.add_header('X-XSS-Protection', '1; mode=block')
+            response.add_header(
+                'Content-Security-Policy', "default-src 'self'")
+            response.add_header(
+                'Strict-Transport-Security',
+                'max-age=31536000; includeSubDomains; preload')
 
     def __init__(self, app):
         app.install_error_callback(self.error_callback)