diff --git a/template/index.mustache b/template/index.mustache
index db8fc02..f8f4ae1 100644
--- a/template/index.mustache
+++ b/template/index.mustache
@@ -1,7 +1,8 @@
 <!DOCTYPE html>
 <html>
 <head>
-  <meta http-equiv="Content-Security-Policy" content="default-src 'self';script-src www.googletagmanager.com 'unsafe-inline';style-src fonts.googleapis.com maxcdn.bootstrapcdn.com 'self'">
+  <meta http-equiv="Content-Security-Policy"
+        content="default-src maxcdn.bootstrapcdn.com 'self';script-src code.jquery.com cdn.jsdelivr.net www.googletagmanager.com 'unsafe-inline' 'self';style-src fonts.googleapis.com maxcdn.bootstrapcdn.com 'self';font-src fonts.gstatic.com fonts.googleapis.com maxcdn.bootstrapcdn.com 'self'">
   <script async src="https://www.googletagmanager.com/gtag/js?id=UA-113065209-1"></script>
   <script>
     window.dataLayer = window.dataLayer || [];
diff --git a/www/index.html b/www/index.html
index 7a161be..2522e88 100644
--- a/www/index.html
+++ b/www/index.html
@@ -1,7 +1,8 @@
 <!DOCTYPE html>
 <html>
 <head>
-  <meta http-equiv="Content-Security-Policy" content="default-src 'self';script-src www.googletagmanager.com 'unsafe-inline';style-src fonts.googleapis.com maxcdn.bootstrapcdn.com 'self'">
+  <meta http-equiv="Content-Security-Policy"
+        content="default-src maxcdn.bootstrapcdn.com 'self';script-src code.jquery.com cdn.jsdelivr.net www.googletagmanager.com 'unsafe-inline' 'self';style-src fonts.googleapis.com maxcdn.bootstrapcdn.com 'self';font-src fonts.gstatic.com fonts.googleapis.com maxcdn.bootstrapcdn.com 'self'">
   <script async src="https://www.googletagmanager.com/gtag/js?id=UA-113065209-1"></script>
   <script>
     window.dataLayer = window.dataLayer || [];
diff --git a/www/past.html b/www/past.html
index 93e0085..0e677f1 100644
--- a/www/past.html
+++ b/www/past.html
@@ -1,7 +1,8 @@
 <!DOCTYPE html>
 <html>
 <head>
-  <meta http-equiv="Content-Security-Policy" content="default-src 'self';script-src www.googletagmanager.com 'unsafe-inline';style-src fonts.googleapis.com maxcdn.bootstrapcdn.com 'self'">
+  <meta http-equiv="Content-Security-Policy"
+        content="default-src maxcdn.bootstrapcdn.com 'self';script-src code.jquery.com cdn.jsdelivr.net www.googletagmanager.com 'unsafe-inline' 'self';style-src fonts.googleapis.com maxcdn.bootstrapcdn.com 'self';font-src fonts.gstatic.com fonts.googleapis.com maxcdn.bootstrapcdn.com 'self'">
   <script async src="https://www.googletagmanager.com/gtag/js?id=UA-113065209-1"></script>
   <script>
     window.dataLayer = window.dataLayer || [];
