Question: I have many of these "controllers": 

```
app.get('/',function(req,res){
    var stuff = { 'title': 'blah' };
    res.render('mytemplate',stuff);
});    

```

Notice res.render? I want to add this header to every response header I make:

`X-XSS-Protection: 0`

How can I add that response header automatically?

Answer: 
Use a [middleware](https://expressjs.com/en/guide/using-middleware.html)...

```
app.use(function (req, res, next) {
  res.header("Access-Control-Allow-Origin", "*")
  res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept")
  next()
})

```

But make sure you use it **before** your API method. Like this:

```
const app = express()

// middleware
app.use(function (req, res, next) {
  res.header("Access-Control-Allow-Origin", "*")
  res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept")
  next()
})

// api
app.get('/user', (req, res, next) => {
  service.doSomething
    .then(data => res.send(data))
    .catch(next)
})

app.use(handleError)

```

Took me a while to figure it out. I didn't see it mentioned anywhere so adding this to complement previous answers.
I'd like to point out that none of these answer actually answer the question; the question is specifically relating to render responses; e.g. for an app like:

```
const router = require('express').Router();
router.use('/test.json', (req, res) => res.json({ test: 'hi' });
router.use('/test.html', (req, res) => res.render('test'));

```

It's not clear how to add headers (e.g. CSP headers, which can be very verbose) *only* to your HTML responses. Express doesn't have a hook to specifically do that. The only option at the moment is to organize your code so you don't have to, e.g.

```
app.use(jsonRouter);
app.use(htmlRouter);

```

...which allows you to do as some of the other answers suggest, and add generic middleware for setting the headers.