diff --git a/docker/build.sh b/docker/build.sh
old mode 100644
new mode 100755
diff --git a/docker/nginx.conf b/docker/nginx.conf
index dce1ffbd61..b33c5bbfaf 100644
--- a/docker/nginx.conf
+++ b/docker/nginx.conf
@@ -12,6 +12,9 @@ http {
     include       /etc/nginx/mime.types;
     default_type  application/octet-stream;
 
+    add_header X-Frame-Options "DENY" always;
+    add_header Content-Security-Policy "frame-ancestors 'none'" always;
+
     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for"';
diff --git a/packages/apps/webpack.serve.cjs b/packages/apps/webpack.serve.cjs
index 7b960acbf2..f508d27fc9 100644
--- a/packages/apps/webpack.serve.cjs
+++ b/packages/apps/webpack.serve.cjs
@@ -11,6 +11,10 @@ module.exports = merge(
   baseConfig(__dirname, 'development'),
   {
     devServer: {
+      headers: {
+        'Content-Security-Policy': "frame-ancestors 'none'",
+        'X-Frame-Options': 'DENY'
+      },
       hot: true,
       open: false,
       port: 3000,