diff --git a/html/class_passwordRecovery.inc b/html/class_passwordRecovery.inc
index 1bc84b093c64530fe35db9fa7979101bb102d304..7b21ea0d0ea823dbdaa8c6fc8c0bccb9e5670fab 100644
--- a/html/class_passwordRecovery.inc
+++ b/html/class_passwordRecovery.inc
@@ -104,6 +104,8 @@ class standAlonePage {
       load_plist();
 
       $ssl = $this->checkForSSL();
+
+      static::securityHeaders();
     }
   }
 
@@ -222,6 +224,13 @@ class standAlonePage {
     return $params;
   }
 
+  static function securityHeaders()
+  {
+    header('X-XSS-Protection: 1; mode=block');
+    header('X-Content-Type-Options: nosniff');
+    header('X-Frame-Options: deny');
+  }
+
   static function generateRandomHash()
   {
     /* Generate a very long random value */
diff --git a/html/index.php b/html/index.php
index 468a9b83df7ac6da5f86c670a2fb7411a560390d..a8abca46a587852b33298c76c25898731102882e 100644
--- a/html/index.php
+++ b/html/index.php
@@ -29,6 +29,7 @@ require_once ("class_logging.inc");
 header('Content-type: text/html; charset=UTF-8');
 header('X-XSS-Protection: 1; mode=block');
 header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: deny');
 
 /* Display the login page and exit() */
 function displayLogin()
diff --git a/html/main.php b/html/main.php
index f1480f8e40fdf79063be525eae640b2df383901b..d762e01abc6c61b9facd7501d05a2a42cc4ad5a1 100644
--- a/html/main.php
+++ b/html/main.php
@@ -31,6 +31,7 @@ require_once ("variables.inc");
 header('Content-type: text/html; charset=UTF-8');
 header('X-XSS-Protection: 1; mode=block');
 header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: deny');
 
 /* Set the text domain as 'fusiondirectory' */
 $domain = 'fusiondirectory';
diff --git a/html/setup.php b/html/setup.php
index 292e5f555fafd6821e9b430b5a48671c207d182c..2319bcb7e7c440e264474014a110d84b521019f1 100644
--- a/html/setup.php
+++ b/html/setup.php
@@ -39,6 +39,7 @@ require_once("../setup/class_setupStepFinish.inc");
 header('Content-type: text/html; charset=UTF-8');
 header('X-XSS-Protection: 1; mode=block');
 header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: deny');
 
 /* Set cookie lifetime to one day (The parameter is in seconds ) */
 session_set_cookie_params(24 * 60 * 60);