diff --git a/Chapter09/http-app/server.js b/Chapter09/http-app/server.js
new file mode 100644
index 0000000..a91eaaf
--- /dev/null
+++ b/Chapter09/http-app/server.js
@@ -0,0 +1,21 @@
+const http = require("http");
+
+const server = http.createServer((req, res) => {
+  secureHeaders(res);
+  res.end("Hello World!");
+});
+
+const secureHeaders = (res) => {
+  res.setHeader("X-DNS-Prefetch-Control", "off");
+  res.setHeader("Expect-CT", "max-age=0");
+  res.setHeader("X-Frame-Options", "SAMEORIGIN");
+  res.setHeader("X-Download-Options", "noopen");
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  res.setHeader("X-Permitted-Cross-Domain-Policies", "none");
+  res.setHeader("Referrer-Policy", "no-referrer");
+  res.setHeader("X-XSS-Protection", "1; mode=block");
+};
+
+server.listen(3000, () => {
+  console.log("Server listening on port 3000");
+});