diff --git a/src/router.js b/src/router.js
index 24d541c..469da1c 100644
--- a/src/router.js
+++ b/src/router.js
@@ -4,6 +4,7 @@ const router = require('express').Router()
 
 // Add CORS headers
 router.use((req, res, next) => {
+  res.header('X-Frame-Options', 'DENY')
   res.header('Access-Control-Allow-Origin', '*')
   res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept')
   next()