diff --git a/src/router.js b/src/router.js
index 16c8baa..e93733b 100644
--- a/src/router.js
+++ b/src/router.js
@@ -3,6 +3,7 @@ const router = require('express').Router()
 
 // Add CORS headers
 router.use((req, res, next) => {
+  res.header('X-Frame-Options', 'DENY')
   res.header('Access-Control-Allow-Origin', '*')
   res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept')
   next()