diff --git a/Sense/server/app/sense/liveview/http.go b/Sense/server/app/sense/liveview/http.go
index 1e0c444..24eecec 100644
--- a/Sense/server/app/sense/liveview/http.go
+++ b/Sense/server/app/sense/liveview/http.go
@@ -61,6 +61,11 @@ func (m *Module) player(w http.ResponseWriter, r *http.Request) {
 	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.Header().Set("Cache-Control", "no-store")
-	w.Header().Set("Content-Security-Policy", "default-src 'none'; frame-src http: https:; style-src 'unsafe-inline'")
+	// This endpoint is the authenticated, same-origin wrapper loaded by the
+	// live-view page. Keep the global DENY policy everywhere else, and allow
+	// only Sense itself to embed this wrapper.
+	w.Header().Set("X-Frame-Options", "SAMEORIGIN")
+	w.Header().Set("Content-Security-Policy", "default-src 'none'; frame-ancestors 'self'; frame-src http: https:; style-src 'unsafe-inline'")
 	_ = playerTemplate.Execute(w, target)
 }
+