anchor.diff:  	return http.build();
   }
   ----
  +
  +.Kotlin
  +[source,kotlin,role="secondary"]
  +----
  +@Bean
  +fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
  +    return http {
  +        // ...
  +        headers {
  +            frameOptions {
  +                mode = SAMEORIGIN
  +            }
  +        }
  +    }
  +}
  +----
   ====
   
   [[webflux-headers-xss-protection]]
   == X-XSS-Protection
   By default, Spring Security instructs browsers to block reflected XSS attacks using the <<headers-xss-protection,X-XSS-Protection header>.
  -You can disable `X-XSS-Protection` with the following Java Configuration:
  +You can disable `X-XSS-Protection` with the following Configuration:
   
   .X-XSS-Protection Customization
   ====
  -[source,java]
  +.Java
  +[source,java,role="primary"]
   ----
   @Bean
   SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
  
positive.code: 
  can be sent on log out with the following configuration:
  
  .Clear-Site-Data Java Configuration
  ====
  [source,java]
  ----
  @Bean
  SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
  
negative.code: [[webflux-headers-content-type-options]]
  == Content Type Options
  Spring Security includes <<headers-content-type-options,Content-Type>> headers by default.
  However, you can disable it with:
  
  .Content Type Options Disabled
  ====
  .Java
  [source,java,role="primary"]
  ----
  @Bean
  SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
  