diff --git a/src/appdb.js b/src/appdb.js
index 951f8ae05..897542040 100644
--- a/src/appdb.js
+++ b/src/appdb.js
@@ -175,13 +175,14 @@ function add(id, appStoreId, manifest, location, portBindings, data, callback) {
     var accessRestrictionJson = JSON.stringify(accessRestriction);
     var memoryLimit = data.memoryLimit || 0;
     var altDomain = data.altDomain || null;
+    var xFrameOptions = data.xFrameOptions || '';
     var installationState = data.installationState || exports.ISTATE_PENDING_INSTALL;
     var lastBackupId = data.lastBackupId || null; // used when cloning
 
     var queries = [ ];
     queries.push({
-        query: 'INSERT INTO apps (id, appStoreId, manifestJson, installationState, location, accessRestrictionJson, memoryLimit, altDomain, lastBackupId) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)',
-        args: [ id, appStoreId, manifestJson, installationState, location, accessRestrictionJson, memoryLimit, altDomain, lastBackupId ]
+        query: 'INSERT INTO apps (id, appStoreId, manifestJson, installationState, location, accessRestrictionJson, memoryLimit, altDomain, xFrameOptions, lastBackupId) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+        args: [ id, appStoreId, manifestJson, installationState, location, accessRestrictionJson, memoryLimit, altDomain, xFrameOptions, lastBackupId ]
     });
 
     Object.keys(portBindings).forEach(function (env) {
diff --git a/src/test/database-test.js b/src/test/database-test.js
index 7141cd9c8..f71eebe07 100644
--- a/src/test/database-test.js
+++ b/src/test/database-test.js
@@ -34,7 +34,7 @@ describe('database', function () {
         database._clear(done);
     });
 
-    describe('userdb', function () {
+    describe('user', function () {
         var USER_0 = {
             id: 'uuid0',
             username: 'uuid0',
@@ -553,7 +553,8 @@ describe('database', function () {
             lastBackupId: null,
             oldConfig: null,
             memoryLimit: 4294967296,
-            altDomain: null
+            altDomain: null,
+            xFrameOptions: 'DENY'
         };
         var APP_1 = {
             id: 'appid-1',
@@ -572,7 +573,8 @@ describe('database', function () {
             lastBackupId: null,
             oldConfig: null,
             memoryLimit: 0,
-            altDomain: null
+            altDomain: null,
+            xFrameOptions: ''
         };
 
         it('add fails due to missing arguments', function () {