diff --git a/docs/npm-advanced.conf b/docs/npm-advanced.conf
index 1ed51b4..5b5a17c 100644
--- a/docs/npm-advanced.conf
+++ b/docs/npm-advanced.conf
@@ -9,7 +9,12 @@
 include /snippets/authelia-location.conf;
 
 location / {
+    # Headers go here, not at server level: a location with its own add_header
+    # (HSTS) doesn't inherit the server's.
     add_header Strict-Transport-Security $hsts_header always;
+    # No other site may frame the terminal (clickjacking).
+    add_header X-Frame-Options "DENY" always;
+    add_header Content-Security-Policy "frame-ancestors 'none'" always;
 
     auth_request /authelia;
     auth_request_set $user $upstream_http_remote_user;