diff --git a/html/index.php b/html/index.php
index bfed93af400f078bef92b2df64939dc844c0edbd..468a9b83df7ac6da5f86c670a2fb7411a560390d 100644
--- a/html/index.php
+++ b/html/index.php
@@ -24,7 +24,11 @@ require_once ("../include/php_setup.inc");
 require_once ("functions.inc");
 require_once ("variables.inc");
 require_once ("class_logging.inc");
-header("Content-type: text/html; charset=UTF-8");
+
+/* Set headers */
+header('Content-type: text/html; charset=UTF-8');
+header('X-XSS-Protection: 1; mode=block');
+header('X-Content-Type-Options: nosniff');
 
 /* Display the login page and exit() */
 function displayLogin()
diff --git a/html/main.php b/html/main.php
index 78f6e0cdd8c35ec49fde7c0b1c0b63fd0b4d8967..f1480f8e40fdf79063be525eae640b2df383901b 100644
--- a/html/main.php
+++ b/html/main.php
@@ -27,8 +27,10 @@ require_once ("../include/php_setup.inc");
 require_once ("functions.inc");
 require_once ("variables.inc");
 
-/* Set header */
-header("Content-type: text/html; charset=UTF-8");
+/* Set headers */
+header('Content-type: text/html; charset=UTF-8');
+header('X-XSS-Protection: 1; mode=block');
+header('X-Content-Type-Options: nosniff');
 
 /* Set the text domain as 'fusiondirectory' */
 $domain = 'fusiondirectory';
diff --git a/html/setup.php b/html/setup.php
index 5a0e39c1fc1e7acb8c1d4fada3538638dd98829e..292e5f555fafd6821e9b430b5a48671c207d182c 100644
--- a/html/setup.php
+++ b/html/setup.php
@@ -35,8 +35,10 @@ require_once("../setup/class_setupStepMigrate.inc");
 require_once("../setup/class_setupStepFinish.inc");
 
 
-/* Set header */
-header("Content-type: text/html; charset=UTF-8");
+/* Set headers */
+header('Content-type: text/html; charset=UTF-8');
+header('X-XSS-Protection: 1; mode=block');
+header('X-Content-Type-Options: nosniff');
 
 /* Set cookie lifetime to one day (The parameter is in seconds ) */
 session_set_cookie_params(24 * 60 * 60);