diff --git a/apps/tandoor/app/route.yaml b/apps/tandoor/app/route.yaml
index e36f3eb..91e9f95 100644
--- a/apps/tandoor/app/route.yaml
+++ b/apps/tandoor/app/route.yaml
@@ -1,4 +1,14 @@
 apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tandoor-headers
+  namespace: tandoor
+spec:
+  headers:
+    frameDeny: true
+    browserXssFilter: true
+---
+apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
   name: recipes-route
@@ -14,6 +24,8 @@ spec:
       port: 80
   - match: Host(`recipes.trivernis.dev`) || Host(`recipes.trivernis.net`)
     kind: Rule
+    middlewares:
+      - name: tandoor-headers
     services:
     - name: tandoor
       port: 8080