diff --git a/config/application.rb b/config/application.rb
index 2b54558e56..5cc2b55610 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -18,6 +18,12 @@ module Doubtfire
   class Application < Rails::Application
     config.load_defaults 7.0
 
+    config.action_dispatch.default_headers.merge!({
+    'X-Frame-Options' => 'DENY',
+    'X-Content-Type-Options' => 'nosniff',
+    'Referrer-Policy' => 'no-referrer',
+    'Permissions-Policy' => 'geolocation=(), camera=(), microphone=()',
+    'Content-Security-Policy' => "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' http://fonts.googleapis.com https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com;"})
     # Remove Action Mailbox and Active Storage routes - not used
     initializer(:remove_action_mailbox_and_activestorage_routes, after: :add_routing_paths) do |app|
       app.routes_reloader.paths.delete_if { |path| path =~ /activestorage/ }