diff --git a/spec/commands/new_command_spec.cr b/spec/commands/new_command_spec.cr
index d68c6ae..9939c0e 100644
--- a/spec/commands/new_command_spec.cr
+++ b/spec/commands/new_command_spec.cr
@@ -114,6 +114,7 @@ describe AmberCLI::Commands::NewCommand do
         config["database"]["url"].as_s.should contain("sqlite3:")
 
         routes = File.read(File.join(destination, "config/routes.cr"))
+        routes.should contain("Amber::Pipe::SecureHeaders.new")
         routes.should contain("pipeline :static")
         routes.should contain("Amber::Pipe::Static.new")
         routes.should contain(%(get "/*", Amber::Controller::Static, :index))
diff --git a/src/amber_cli/commands/new.cr b/src/amber_cli/commands/new.cr
index 0876509..7d754d8 100644
--- a/src/amber_cli/commands/new.cr
+++ b/src/amber_cli/commands/new.cr
@@ -457,6 +457,7 @@ CONTROLLER
       routes_content = <<-ROUTES
 Amber::Server.configure do
   pipeline :web do
+    plug Amber::Pipe::SecureHeaders.new
     plug Amber::Pipe::Error.new
     plug Amber::Pipe::Logger.new
     plug Amber::Pipe::Session.new
@@ -465,11 +466,13 @@ Amber::Server.configure do
   end
 
   pipeline :static do
+    plug Amber::Pipe::SecureHeaders.new
     plug Amber::Pipe::Error.new
     plug Amber::Pipe::Static.new("./public")
   end
 
   pipeline :api do
+    plug Amber::Pipe::SecureHeaders.new
     plug Amber::Pipe::Error.new
     plug Amber::Pipe::Logger.new
   end
diff --git a/src/amber_cli/templates/app/config/routes.cr.ecr b/src/amber_cli/templates/app/config/routes.cr.ecr
index c3343f8..c16fb6f 100644
--- a/src/amber_cli/templates/app/config/routes.cr.ecr
+++ b/src/amber_cli/templates/app/config/routes.cr.ecr
@@ -1,5 +1,6 @@
 Amber::Server.configure do
   pipeline :web do
+    plug Amber::Pipe::SecureHeaders.new
     plug Amber::Pipe::Error.new
     plug Amber::Pipe::Logger.new
     plug Amber::Pipe::Session.new
@@ -8,6 +9,7 @@ Amber::Server.configure do
   end
 
   pipeline :static do
+    plug Amber::Pipe::SecureHeaders.new
     plug Amber::Pipe::Error.new
     plug Amber::Pipe::Static.new("./public")
   end