Add the X-Content-Type-Options header to the response.
See: wrap-content-type-options.

Add the X-Frame-Options header to the response. See: wrap-frame-options.

Middleware that adds the X-Content-Type-Options header to the response. This
currently only accepts one option:
:nosniff - prevent resources with invalid media types being loaded as
           stylesheets or scripts
This prevents attacks based around media type confusion. See:
http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx

Middleware that adds the X-Frame-Options header to the response. This governs
whether your site can be rendered in a <frame>, <iframe> or <object>, and is
typically used to prevent clickjacking attacks.
The following frame options are allowed:
:deny             - prevent any framing of the content
:sameorigin       - allow only the current site to frame the content
{:allow-from uri} - allow only the specified URI to frame the page
The :deny and :sameorigin options are keywords, while the :allow-from option
is a map consisting of one key/value pair.
Note that browser support for :allow-from is incomplete. See:
https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options

Middleware that adds the X-XSS-Protection header to the response. This header
enables a heuristic filter in browsers for detecting cross-site scripting
attacks. Usually on by default.
The :enable? key determines whether the filter should be turned on.
:mode - currently accepts only :block
See: http://msdn.microsoft.com/en-us/library/dd565647(v=vs.85).aspx

Add the X-XSS-Protection header to the response. See: wrap-xss-protection.