code: private function setSecurityHeaders()
      {
          $headers = Yii::$app->response->headers;
          $headers->add('X-Frame-Options', 'DENY');
          $headers->add('X-XSS-Protection', '1');
      }
docs: Set Headers to prevent Click-jacking and XSS
  @author Adegoke Obasa <goke@cottacush.com>