diff --git a/cps/web.py b/cps/web.py
index 006c7f3d..752555c5 100644
--- a/cps/web.py
+++ b/cps/web.py
@@ -129,12 +129,10 @@ if feature_support['ldap']:
 @app.after_request
 def add_security_headers(resp):
     # resp.headers['Content-Security-Policy']= "script-src 'self' https://www.googleapis.com https://api.douban.com https://comicvine.gamespot.com;"
-    if "tolino" not in request.headers.get('User-Agent'):
-        resp.headers['X-Content-Type-Options'] = 'nosniff'
-        resp.headers['X-Frame-Options'] = 'SAMEORIGIN'
-        resp.headers['X-XSS-Protection'] = '1; mode=block'
-        resp.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
-    log.debug(request.full_path)
+    resp.headers['X-Content-Type-Options'] = 'nosniff'
+    resp.headers['X-Frame-Options'] = 'SAMEORIGIN'
+    resp.headers['X-XSS-Protection'] = '1; mode=block'
+    resp.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
     log.debug(request.headers)
     return resp