diff --git a/config/config.php b/config/config.php
index 856f8ed5e3..22a08b57a1 100644
--- a/config/config.php
+++ b/config/config.php
@@ -89,6 +89,10 @@ $config->domainPostfix .= "|villas|foundation|expert|works|tools|watch|zone|barg
 $config->domainPostfix .= "|farm|pics|photo|marketing|holiday|gift|buzz|guitars|trade|construction|";
 $config->domainPostfix .= "|international|house|coffee|florist|rich|ceo|camp|education|repair|win|site|";
 
+/* Config for Content-Security-Policy. */
+$config->CSPs = array();
+$config->CSPs[] = "form-action 'self';connect-src 'self'";
+
 /* 系统框架配置。Framework settings. */
 $config->framework = new stdclass();
 $config->framework->autoConnectDB   = true;  // 是否自动连接数据库。              Whether auto connect database or not.
@@ -107,6 +111,12 @@ $config->framework->autoRepairTable = true;
 $config->framework->autoLang        = false;
 $config->framework->filterCSRF      = false;
 $config->framework->setCookieSecure = true;
+$config->framework->sendXCTO        = true;   // Send X-Content-Type-Options header.
+$config->framework->sendXXP         = true;   // Send X-XSS-Protection header.
+$config->framework->sendHSTS        = true;   // Send HTTP Strict Transport Security header.
+$config->framework->sendRP          = true;   // Send Referrer-Policy header.
+$config->framework->sendXPCDP       = true;   // Send X-Permitted-Cross-Domain-Policies header.
+$config->framework->sendXDO         = true;   // Send X-Download-Options header.
 
 $config->framework->detectDevice['zh-cn'] = true; // 在zh-cn语言情况下，是否启用设备检测功能。 Whether enable device detect or not.
 $config->framework->detectDevice['zh-tw'] = true; // 在zh-tw语言情况下，是否启用设备检测功能。 Whether enable device detect or not.
diff --git a/module/common/model.php b/module/common/model.php
index 118bb7b954..44f67edc9a 100644
--- a/module/common/model.php
+++ b/module/common/model.php
@@ -47,6 +47,20 @@ class commonModel extends model
         header("Content-Type: text/html; Language={$this->config->charset}");
         header("Cache-control: private");
 
+        /* Send HTTP header. */
+        if($this->config->framework->sendXCTO)  header("X-Content-Type-Options: nosniff");
+        if($this->config->framework->sendXXP)   header("X-XSS-Protection: 1; mode=block");
+        if($this->config->framework->sendHSTS)  header("Strict-Transport-Security: max-age=3600; includeSubDomains");
+        if($this->config->framework->sendRP)    header("Referrer-Policy: no-referrer-when-downgrade");
+        if($this->config->framework->sendXPCDP) header("X-Permitted-Cross-Domain-Policies: master-only");
+        if($this->config->framework->sendXDO)   header("X-Download-Options: noopen");
+
+        /* Set Content-Security-Policy header. */
+        if($this->config->CSPs)
+        {
+            foreach($this->config->CSPs as $CSP) header("Content-Security-Policy: $CSP;");
+        }
+
         if($this->loadModel('setting')->getItem('owner=system&module=sso&key=turnon'))
         {
             if(isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == 'on')