diff --git a/src/app/mod.rs b/src/app/mod.rs
index aba89b8..267d075 100644
--- a/src/app/mod.rs
+++ b/src/app/mod.rs
@@ -260,7 +260,7 @@ async fn add_non_asset_security_headers(request: Request, next: Next) -> Respons
 
     let mut response = next.run(request).await;
 
-    if is_file {
+    if is_file && is_asset && is_icon {
         let headers = response.headers_mut();
         headers.remove("x-frame-options");
         headers.remove("cross-origin-opener-policy");