diff --git a/html/index.php b/html/index.php
index 0b37df700775fd0f2141d45f93a533ad8e96b899..85df945a3de3917e32a3a11888c2a78a97066b70 100644
--- a/html/index.php
+++ b/html/index.php
@@ -24,7 +24,11 @@ require_once ("../include/php_setup.inc");
 require_once ("functions.inc");
 require_once ("variables.inc");
 require_once ("class_logging.inc");
-header("Content-type: text/html; charset=UTF-8");
+
+/* Set headers */
+header('Content-type: text/html; charset=UTF-8');
+header('X-XSS-Protection: 1; mode=block');
+header('X-Content-Type-Options: nosniff');
 
 /* Display the login page and exit() */
 function displayLogin()
diff --git a/html/main.php b/html/main.php
index 1d03fbac5a31278d610d6027dddb3ff39cc13bf1..27cb051648ed22d0fda30034b6aa217bce46ec14 100644
--- a/html/main.php
+++ b/html/main.php
@@ -27,8 +27,10 @@ require_once ("../include/php_setup.inc");
 require_once ("functions.inc");
 require_once ("variables.inc");
 
-/* Set header */
-header("Content-type: text/html; charset=UTF-8");
+/* Set headers */
+header('Content-type: text/html; charset=UTF-8');
+header('X-XSS-Protection: 1; mode=block');
+header('X-Content-Type-Options: nosniff');
 
 /* Set the text domain as 'fusiondirectory' */
 $domain = 'fusiondirectory';
diff --git a/html/setup.php b/html/setup.php
index 70378bb11405d566f59b73b62813ab83318f46b2..f9763e431d17adf1acefad820961e3caa0583a9c 100644
--- a/html/setup.php
+++ b/html/setup.php
@@ -35,8 +35,10 @@ require_once("../setup/class_setupStepMigrate.inc");
 require_once("../setup/class_setupStepFinish.inc");
 
 
-/* Set header */
-header("Content-type: text/html; charset=UTF-8");
+/* Set headers */
+header('Content-type: text/html; charset=UTF-8');
+header('X-XSS-Protection: 1; mode=block');
+header('X-Content-Type-Options: nosniff');
 
 /* Set cookie lifetime to one day (The parameter is in seconds ) */
 session_set_cookie_params(24 * 60 * 60);