diff --git a/composer.lock b/composer.lock
index 4b28a607..f4d1ec61 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "2ef2df59ab7af408bda8770f685e1b8b",
+    "content-hash": "8fbc9b3f588952a1b4249a317964d3d4",
     "packages": [
         {
             "name": "b13/container",
diff --git a/public/typo3conf/ext/ep_events/Configuration/TypoScript/setup.typoscript b/public/typo3conf/ext/ep_events/Configuration/TypoScript/setup.typoscript
index 046fa6d4..8e05ac73 100644
--- a/public/typo3conf/ext/ep_events/Configuration/TypoScript/setup.typoscript
+++ b/public/typo3conf/ext/ep_events/Configuration/TypoScript/setup.typoscript
@@ -84,6 +84,23 @@ config {
     compressJs = 1
     compressCss = 1
     typolinkEnableLinksAcrossDomains = 1
+    additionalHeaders {
+        10 {
+            header = Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-inline'
+        }
+        20 {
+            header = Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
+        }
+        30 {
+            header = X-Frame-Options: sameorigin
+        }
+        40 {
+            header = Referrer-Policy: same-origin
+        }
+        50 {
+            header = Permissions-Policy: microphone=(), camera=()
+        }
+    }
 }
 
 [siteLanguage("languageId") == "1"]
diff --git a/public/typo3conf/ext/ep_theme/Configuration/TypoScript/setup.typoscript b/public/typo3conf/ext/ep_theme/Configuration/TypoScript/setup.typoscript
index f6c950bb..3887c057 100644
--- a/public/typo3conf/ext/ep_theme/Configuration/TypoScript/setup.typoscript
+++ b/public/typo3conf/ext/ep_theme/Configuration/TypoScript/setup.typoscript
@@ -102,4 +102,21 @@ config {
     sendCacheHeaders = 1
     content_from_pid_allowOutsideDomain = 1
     inlineStyle2TempFile = 0
+    additionalHeaders {
+        10 {
+            header = Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-inline'
+        }
+        20 {
+            header = Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
+        }
+        30 {
+            header = X-Frame-Options: sameorigin
+        }
+        40 {
+            header = Referrer-Policy: same-origin
+        }
+        50 {
+            header = Permissions-Policy: microphone=(), camera=()
+        }
+    }
 }