diff --git a/firefly/docker-compose.yml b/firefly/docker-compose.yml
index 54cc274..9f2ba2f 100644
--- a/firefly/docker-compose.yml
+++ b/firefly/docker-compose.yml
@@ -24,6 +24,7 @@ services:
       - "traefik.http.routers.firefly.rule=Host(`${APP_DOMAIN}`)"
       - "traefik.http.routers.firefly.entrypoints=websecure"
       - "traefik.http.routers.firefly.tls.certresolver=myresolver"
+      - "traefik.http.routers.firefly.middlewares=default-headers@file"
 
   fireflyiiidb:
     image: postgres:10-alpine
diff --git a/gitea/docker-compose.yml b/gitea/docker-compose.yml
index d9f8bde..cf9b61b 100644
--- a/gitea/docker-compose.yml
+++ b/gitea/docker-compose.yml
@@ -35,6 +35,7 @@ services:
       - "traefik.http.routers.git.entrypoints=websecure"
       - "traefik.http.routers.git.tls.certresolver=myresolver"
       - "traefik.http.services.git.loadbalancer.server.port=3000"
+      - "traefik.http.routers.git.middlewares=default-headers@file"
     ports:
       - "2222:22"
     links:
diff --git a/jitsi/docker-compose.yml b/jitsi/docker-compose.yml
index fec95e4..6a39c69 100644
--- a/jitsi/docker-compose.yml
+++ b/jitsi/docker-compose.yml
@@ -51,6 +51,7 @@ services:
             - "traefik.http.routers.jitsi.rule=Host(`jitsi.zweili.org`)"
             - "traefik.http.routers.jitsi.entrypoints=websecure"
             - "traefik.http.routers.jitsi.tls.certresolver=myresolver"
+              - "traefik.http.routers.jitsi.middlewares=default-headers@file"
         networks:
             meet.jitsi:
                 aliases:
diff --git a/nextcloud/docker-compose.yml b/nextcloud/docker-compose.yml
index 3b8a91d..0e59e89 100644
--- a/nextcloud/docker-compose.yml
+++ b/nextcloud/docker-compose.yml
@@ -58,6 +58,7 @@ services:
       - "traefik.http.routers.nextcloud.rule=Host(`${APP_DOMAIN}`)"
       - "traefik.http.routers.nextcloud.entrypoints=websecure"
       - "traefik.http.routers.nextcloud.tls.certresolver=myresolver"
+      - "traefik.http.routers.nextcloud.middlewares=default-headers@file"
     restart: unless-stopped
 
   cron:
diff --git a/rainloop/docker-compose.yml b/rainloop/docker-compose.yml
index f052fc5..62f0c52 100644
--- a/rainloop/docker-compose.yml
+++ b/rainloop/docker-compose.yml
@@ -23,6 +23,7 @@ services:
       - "traefik.http.routers.rainloop.rule=Host(`${APP_DOMAIN}`)"
       - "traefik.http.routers.rainloop.entrypoints=websecure"
       - "traefik.http.routers.rainloop.tls.certresolver=myresolver"
+      - "traefik.http.routers.rainloop.middlewares=default-headers@file"
     restart: unless-stopped
     links:
       - db:db
diff --git a/shaarli/docker-compose.yml b/shaarli/docker-compose.yml
index 946b1ee..bcc32ce 100644
--- a/shaarli/docker-compose.yml
+++ b/shaarli/docker-compose.yml
@@ -22,6 +22,7 @@ services:
       - "traefik.http.routers.shaarli-andreas.rule=Host(`shaarli-andreas.2li.ch`)"
       - "traefik.http.routers.shaarli-andreas.entrypoints=websecure"
       - "traefik.http.routers.shaarli-andreas.tls.certresolver=myresolver"
+      - "traefik.http.routers.shaarli-andreas.middlewares=default-headers@file"
     restart: unless-stopped
 
   shaarli-gecko:
@@ -35,4 +36,5 @@ services:
       - "traefik.http.routers.shaarli-gecko.rule=Host(`shaarli-gecko.2li.ch`)"
       - "traefik.http.routers.shaarli-gecko.entrypoints=websecure"
       - "traefik.http.routers.shaarli-gecko.tls.certresolver=myresolver"
+      - "traefik.http.routers.shaarli-gecko.middlewares=default-headers@file"
     restart: unless-stopped
diff --git a/ttrss/docker-compose.yml b/ttrss/docker-compose.yml
index 51c8509..a71c381 100644
--- a/ttrss/docker-compose.yml
+++ b/ttrss/docker-compose.yml
@@ -39,6 +39,7 @@ services:
       - "traefik.http.routers.ttrss.rule=Host(`${APP_DOMAIN}`)"
       - "traefik.http.routers.ttrss.entrypoints=websecure"
       - "traefik.http.routers.ttrss.tls.certresolver=myresolver"
+      - "traefik.http.routers.ttrss.middlewares=default-headers@file"
     restart: always
 
   db:
diff --git a/wallabag/docker-compose.yml b/wallabag/docker-compose.yml
index ef5d669..24ef086 100644
--- a/wallabag/docker-compose.yml
+++ b/wallabag/docker-compose.yml
@@ -41,6 +41,7 @@ services:
       - "traefik.http.routers.wallabag.rule=Host(`${APP_DOMAIN}`)"
       - "traefik.http.routers.wallabag.entrypoints=websecure"
       - "traefik.http.routers.wallabag.tls.certresolver=myresolver"
+      - "traefik.http.routers.wallabag.middlewares=default-headers@file"
     restart: unless-stopped
   db:
     image: mariadb