diff --git a/Post/test.py b/Post/test.py
index 77adc32..28982e4 100755
--- a/Post/test.py
+++ b/Post/test.py
@@ -267,6 +267,12 @@ class CSPTest(TestCase):
             self.assertNotIn("unsafe-inline", csp)
             self.assertNotIn("unsafe-eval", csp)
 
+    def test_security_headers(self):
+        response = self.client.get('/Statistics/')
+        self.assertEqual(response['X-Frame-Options'], 'DENY')
+        self.assertEqual(response['X-Content-Type-Options'], 'nosniff')
+        self.assertEqual(response['Referrer-Policy'], 'same-origin')
+
     def test_csp_report_only(self):
         with override_settings(CONTENT_SECURITY_POLICY_REPORT_ONLY=True):
             # New client so the middleware picks up the setting
diff --git a/project/settings.py b/project/settings.py
index 28e526b..97c179c 100644
--- a/project/settings.py
+++ b/project/settings.py
@@ -132,15 +132,14 @@ STATICFILES_FINDERS = (
 SECRET_KEY = 'changeme'
 
 MIDDLEWARE = [
-    'django.middleware.common.CommonMiddleware',
+    'django.middleware.security.SecurityMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
+    'django.middleware.common.CommonMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
-    'django.contrib.sessions.middleware.SessionMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
+    'django.middleware.clickjacking.XFrameOptionsMiddleware',
     'Post.middleware.ContentSecurityPolicyMiddleware',
-    # Uncomment the next line for simple clickjacking protection:
-    # 'django.middleware.clickjacking.XFrameOptionsMiddleware',
 ]
 
 ROOT_URLCONF = 'project.urls'
diff --git a/project/settings.py.docker b/project/settings.py.docker
index bce1347..70c9253 100644
--- a/project/settings.py.docker
+++ b/project/settings.py.docker
@@ -126,15 +126,14 @@ STATICFILES_FINDERS = (
 SECRET_KEY = os.environ.get('SECRET_KEY', 'changeme')
 
 MIDDLEWARE = [
-    'django.middleware.common.CommonMiddleware',
+    'django.middleware.security.SecurityMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
+    'django.middleware.common.CommonMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
-    'django.contrib.sessions.middleware.SessionMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
+    'django.middleware.clickjacking.XFrameOptionsMiddleware',
     'Post.middleware.ContentSecurityPolicyMiddleware',
-    # Uncomment the next line for simple clickjacking protection:
-    # 'django.middleware.clickjacking.XFrameOptionsMiddleware',
 ]
 
 ROOT_URLCONF = 'project.urls'