diff --git a/common/src/main/java/de/bluecolored/bluemap/common/plugin/Plugin.java b/common/src/main/java/de/bluecolored/bluemap/common/plugin/Plugin.java
index 5c6e92bc6..e1b54e80c 100644
--- a/common/src/main/java/de/bluecolored/bluemap/common/plugin/Plugin.java
+++ b/common/src/main/java/de/bluecolored/bluemap/common/plugin/Plugin.java
@@ -241,7 +241,7 @@ private void load(@Nullable ResourcePack preloadedResourcePack) throws IOExcepti
                         webRequestHandler.register(
                                 "maps/" + Pattern.quote(id) + "/(.*)",
                                 "$1",
-                                new BlueMapResponseModifier(mapRequestHandler)
+                                mapRequestHandler
                         );
                     }
 
@@ -260,7 +260,7 @@ private void load(@Nullable ResourcePack preloadedResourcePack) throws IOExcepti
                         webServer = new HttpServer(
                                 "BlueMap-Webserver",
                                 new LoggingRequestHandler(
-                                        webRequestHandler,
+                                        new BlueMapResponseModifier(webRequestHandler),
                                         webserverConfig.getLog().getFormat(),
                                         webLogger
                                 )
diff --git a/common/src/main/java/de/bluecolored/bluemap/common/web/BlueMapResponseModifier.java b/common/src/main/java/de/bluecolored/bluemap/common/web/BlueMapResponseModifier.java
index 25748f2e3..0718727e9 100644
--- a/common/src/main/java/de/bluecolored/bluemap/common/web/BlueMapResponseModifier.java
+++ b/common/src/main/java/de/bluecolored/bluemap/common/web/BlueMapResponseModifier.java
@@ -28,7 +28,6 @@
 import de.bluecolored.bluemap.common.web.http.HttpRequestHandler;
 import de.bluecolored.bluemap.common.web.http.HttpResponse;
 import de.bluecolored.bluemap.common.web.http.HttpStatusCode;
-import de.bluecolored.bluemap.core.BlueMap;
 import lombok.Getter;
 import lombok.NonNull;
 import lombok.Setter;
@@ -41,7 +40,6 @@ public class BlueMapResponseModifier implements HttpRequestHandler {
 
     public BlueMapResponseModifier(HttpRequestHandler delegate) {
         this.delegate = delegate;
-        this.serverName = "BlueMap/" + BlueMap.VERSION;
     }
 
     @Override
@@ -53,7 +51,12 @@ public HttpResponse handle(HttpRequest request) {
             response.setBody(status.getCode() + " - " + status.getMessage() + "\n" + this.serverName);
         }
 
-        response.addHeader("Server", this.serverName);
+        response.addHeader("Server", "BlueMap");
+        response.addHeader("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; object-src 'none';");
+        response.addHeader("X-Frame-Options", "SAMEORIGIN");
+        response.addHeader("X-Content-Type-Options", "nosniff");
+        response.addHeader("Referrer-Policy", "strict-origin-when-cross-origin");
+        response.addHeader("Permissions-Policy", "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(self), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()");
 
         return response;
     }