diff --git a/server/package.json b/server/package.json
index b028fe294..37397044c 100644
--- a/server/package.json
+++ b/server/package.json
@@ -55,6 +55,7 @@
         "express-session": "1.17.2",
         "fast-json-stable-hash": "1.0.2",
         "fast-xml-parser": "3.19.0",
+        "helmet": "4.6.0",
         "json5": "2.2.0",
         "mkdirp": "1.0.4",
         "mongodb": "3.6.3",
diff --git a/server/pnpm-lock.yaml b/server/pnpm-lock.yaml
index c32118f9c..d70adbb1c 100644
--- a/server/pnpm-lock.yaml
+++ b/server/pnpm-lock.yaml
@@ -35,6 +35,7 @@ specifiers:
   express-session: 1.17.2
   fast-json-stable-hash: 1.0.2
   fast-xml-parser: 3.19.0
+  helmet: 4.6.0
   json5: 2.2.0
   mkdirp: 1.0.4
   mongodb: 3.6.3
@@ -68,6 +69,7 @@ dependencies:
   express-session: 1.17.2
   fast-json-stable-hash: 1.0.2
   fast-xml-parser: 3.19.0
+  helmet: 4.6.0
   json5: 2.2.0
   mkdirp: 1.0.4
   mongodb: 3.6.3
@@ -2120,6 +2122,11 @@ packages:
       is-stream: 2.0.0
       type-fest: 0.8.1
 
+  /helmet/4.6.0:
+    resolution: {integrity: sha512-HVqALKZlR95ROkrnesdhbbZJFi/rIVSoNq6f3jA/9u6MIbTsPh3xZwihjeI5+DO/2sOV6HMHooXcEOuwskHpTg==}
+    engines: {node: '>=10.0.0'}
+    dev: false
+
   /hosted-git-info/2.8.9:
     resolution: {integrity: sha512-mxIDAb9Lsm6DoOJ7xH+5+X4y1LU/4Hi50L9C5sIswK3JzULS4bwk1FvjdBgvYR4bzT4tuUQiC15FE2f5HbLvYw==}
     dev: true
diff --git a/server/src/server/server.ts b/server/src/server/server.ts
index 6dc54969b..896d84ae1 100644
--- a/server/src/server/server.ts
+++ b/server/src/server/server.ts
@@ -6,6 +6,7 @@ import { integer } from "tachi-common";
 import { RedisClient } from "../external/redis/redis";
 import { CONFIG, SESSION_SECRET } from "../lib/setup/config";
 import connectRedis from "connect-redis";
+import helmet from "helmet";
 
 const logger = CreateLogCtx(__filename);
 
@@ -36,6 +37,8 @@ const userSessionMiddleware = expressSession({
 
 const app: Express = express();
 
+app.use(helmet());
+
 app.use(userSessionMiddleware);
 
 // Most of these options are leveraged from KTAPI