diff --git a/config/application.rb b/config/application.rb
index 2ea5e51ef6..3b85f3b20b 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -30,7 +30,10 @@ class Application < Rails::Application
     config.action_dispatch.default_headers = {
       "X-Frame-Options" => "SAMEORIGIN",
       "X-XSS-Protection" => "1; mode=block",
-      "X-Content-Type-Options" => "nosniff"
+      "X-Content-Type-Options" => "nosniff",
+      "X-Download-Options" => "noopen",
+      "X-Permitted-Cross-Domain-Policies" => "none",
+      "Referrer-Policy" => "strict-origin-when-cross-origin"
     }
 
     # Settings in config/environments/* take precedence over those specified here.