diff --git a/src/views/activity.js b/src/views/activity.js
index 39d19a60d..aa81ac029 100644
--- a/src/views/activity.js
+++ b/src/views/activity.js
@@ -170,12 +170,8 @@ angular.module('Application').controller('ActivityController', ['$scope', '$loca
                 return 'Automatic backups of ' + name + ' was ' + (data.enableBackup ? 'enabled' : 'disabled');
             } else if ('enableAutomaticUpdate' in data) {
                 return 'Automatic updates of ' + name + ' was ' + (data.enableAutomaticUpdate ? 'enabled' : 'disabled');
-            } else if ('robotsTxt' in data) {
-                if (data.robotsTxt) {
-                    return 'robots.txt of ' + name + ' was set';
-                } else {
-                    return 'robots.txt of ' + name + ' was reset';
-                }
+            } else if ('reverseProxyConfig' in data) {
+                return 'Reverse proxy configuration of ' + name + ' was updated';
             } else if ('cert' in data) {
                 if (data.cert) {
                     return 'Custom certificate was set for ' + name;
diff --git a/src/views/app.html b/src/views/app.html
index 974875c41..c0d8f2d42 100644
--- a/src/views/app.html
+++ b/src/views/app.html
@@ -625,17 +625,24 @@
               <form role="form" name="securityForm" ng-submit="security.submit()" autocomplete="off">
                 <div class="form-group">
                   <label class="control-label" style="width: 100%">Specify robots.txt file content  <sup><a ng-href="{{ config.webServerOrigin }}/documentation/apps/#indexing-by-search-engines-robotstxt" class="help" target="_blank"><i class="fa fa-question-circle"></i></a></sup> <a href="" class="pull-right" style="font-weight: normal;" ng-click="security.robotsTxt = ROBOTS_DISABLE_INDEXING_TEMPLATE">Disable indexing</a></label>
-                  <textarea ng-model="security.robotsTxt" placeholder="Leave empty to allow all bots to index this app." class="form-control" rows="4"></textarea>
+                  <textarea ng-model="security.robotsTxt" placeholder="Leave empty to allow all bots to index this app" class="form-control" rows="4"></textarea>
                 </div>
 
-                <input class="ng-hide" type="submit" ng-disabled="security.robotsTxt === security.currentRobotsTxt || securityForm.$invalid || security.busy"/>
+                <div class="form-group">
+                  <label class="control-label" style="width: 100%">Content Embedding</label>
+                  <p>Provide a space-separated list of domains that can embed this app</p>
+                  <input type="text" class="form-control" ng-model="security.frameAncestors" placeholder="example.com *.example.com"></input>
+                </div>
+
+                <input class="ng-hide" type="submit" ng-disabled="securityForm.$invalid || security.busy"/>
               </form>
             </fieldset>
           </div>
         </div>
+        <br/>
         <div class="row">
           <div class="col-md-12 text-right">
-            <button class="btn btn-outline btn-primary pull-right" ng-click="security.submit()" ng-disabled="security.robotsTxt === security.currentRobotsTxt || security.$invalid || security.busy"><i class="fa fa-circle-notch fa-spin" ng-show="security.busy"></i> Save</button>
+            <button class="btn btn-outline btn-primary pull-right" ng-click="security.submit()" ng-disabled="security.$invalid || security.busy"><i class="fa fa-circle-notch fa-spin" ng-show="security.busy"></i> Save</button>
           </div>
         </div>
       </div>
diff --git a/src/views/app.js b/src/views/app.js
index 1d883988d..1b14ebf38 100644
--- a/src/views/app.js
+++ b/src/views/app.js
@@ -493,25 +493,29 @@ angular.module('Application').controller('AppController', ['$scope', '$location'
         error: {},
         success: false,
 
-        currentRobotsTxt: '',
         robotsTxt: '',
+        frameAncestors: '',
 
         show: function () {
-            var app = $scope.app;
-
             $scope.security.error = {};
-            $scope.security.currentRobotsTxt = app.robotsTxt;
-            $scope.security.robotsTxt = $scope.security.currentRobotsTxt;
+            $scope.security.robotsTxt = $scope.app.reverseProxyConfig.robotsTxt || '';
+            $scope.security.frameAncestors = ($scope.app.reverseProxyConfig.frameAncestors || []).join(' ');
         },
 
         submit: function () {
             $scope.security.busy = true;
             $scope.security.error = {};
 
-            Client.configureApp($scope.app.id, 'robots_txt', { robotsTxt: $scope.security.robotsTxt }, function (error) {
-                if (error) return Client.error(error);
+            var fa = $scope.security.frameAncestors.split(' ').map(function (t) { return t.trim(); }).filter(function (t) { return !!t; });
 
-                $scope.security.currentRobotsTxt = $scope.security.robotsTxt;
+            var reverseProxyConfig = {
+                robotsTxt: $scope.security.robotsTxt,
+                frameAncestors: fa,
+                hideHeaders: []
+            };
+
+            Client.configureApp($scope.app.id, 'reverse_proxy', reverseProxyConfig, function (error) {
+                if (error) return Client.error(error);
 
                 $timeout(function () {
                     $scope.security.success = true;