diff --git a/src/Application.php b/src/Application.php
index <HASH>..<HASH> 100644
--- a/src/Application.php
+++ b/src/Application.php
@@ -477,6 +477,9 @@ class Application extends Silex\Application
         // Start the 'stopwatch' for the profiler.
         $this['stopwatch']->start('bolt.app.after');
 
+        $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
+        $response->headers->set('Frame-Options', 'SAMEORIGIN');
+
         // true if we need to consider adding html snippets
         if (isset($this['htmlsnippets']) && ($this['htmlsnippets'] === true)) {
             // only add when content-type is text/html
Refuse to display Bolt in an iframe, to prevent possible clickjacking. See #<I>.

Thanks, @narendrabhati