diff --git a/ide/static/js/content.js b/ide/static/js/content.js
index 9a0c92d4c..0771bcb1a 100644
--- a/ide/static/js/content.js
+++ b/ide/static/js/content.js
@@ -527,6 +527,10 @@ class Content extends React.Component {
 
     $.ajax({
       url: 'layer_parameter/',
+      headers: { 
+        'X-Content-Type-Options' : 'nosniff',
+        'X-XSS-Protection' : '1; mode=block' 
+      },
       dataType: 'json',
       type: 'POST',
       async: false,
@@ -623,6 +627,10 @@ class Content extends React.Component {
     const netData = JSON.parse(JSON.stringify(this.state.net));
     $.ajax({
       url: 'model_parameter/',
+      headers: { 
+        'X-Content-Type-Options' : 'nosniff',
+        'X-XSS-Protection' : '1; mode=block' 
+      },
       dataType: 'json',
       type: 'POST',
       data: {
@@ -738,6 +746,10 @@ class Content extends React.Component {
     data['Bias']['params']['filler']['options'] = fillers;
     $.ajax({
       url: url[framework],
+      headers: { 
+        'X-Content-Type-Options' : 'nosniff',
+        'X-XSS-Protection' : '1; mode=block' 
+      },
       dataType: 'json',
       type: 'POST',
       data: formData,
@@ -985,6 +997,10 @@ class Content extends React.Component {
 
     $.ajax({
       url: '/save',
+      headers: { 
+        'X-Content-Type-Options' : 'nosniff',
+        'X-XSS-Protection' : '1; mode=block' 
+      },
       dataType: 'json',
       type: 'POST',
       data: {
@@ -1061,6 +1077,10 @@ class Content extends React.Component {
     this.dismissAllErrors();
     $.ajax({
       url: '/load',
+      headers: { 
+        'X-Content-Type-Options' : 'nosniff',
+        'X-XSS-Protection' : '1; mode=block' 
+      },
       dataType: 'json',
       type: 'POST',
       data: {
@@ -1189,6 +1209,10 @@ class Content extends React.Component {
   updateHistoryModal() {
     $.ajax({
       url: '/model_history',
+      headers: { 
+        'X-Content-Type-Options' : 'nosniff',
+        'X-XSS-Protection' : '1; mode=block' 
+      },
       dataType: 'json',
       type: 'POST',
       data: {
diff --git a/ide/static/js/login.js b/ide/static/js/login.js
index a31214afa..56cb68f14 100644
--- a/ide/static/js/login.js
+++ b/ide/static/js/login.js
@@ -18,6 +18,10 @@ class Login extends React.Component {
   logoutUser() {
     $.ajax({
       url: '/accounts/logout',
+      headers: { 
+        'X-Content-Type-Options' : 'nosniff',
+        'X-XSS-Protection' : '1; mode=block' 
+      },
       type: 'GET',
       processData: false,  // tell jQuery not to process the data
       contentType: false,
@@ -56,6 +60,10 @@ class Login extends React.Component {
 
     $.ajax({
       url: '/backendAPI/checkLogin',
+      headers: { 
+        'X-Content-Type-Options' : 'nosniff',
+        'X-XSS-Protection' : '1; mode=block' 
+      },
       type: 'GET',
       contentType: false,
       data: {
diff --git a/ide/views.py b/ide/views.py
index 9cd03ea87..8907266ab 100644
--- a/ide/views.py
+++ b/ide/views.py
@@ -12,7 +12,10 @@
 
 
 def index(request):
-    return render(request, 'index.html')
+    response = render(request, "index.html", {})
+    response['X-Content-Type-Options'] = 'nosniff'
+    response['X-XSS-Protection'] = '1'
+    return response
 
 
 @csrf_exempt