diff --git a/template/index.mustache b/template/index.mustache
index 3b4dc35..67d85b4 100644
--- a/template/index.mustache
+++ b/template/index.mustache
@@ -1,6 +1,7 @@
 <!DOCTYPE html>
 <html>
 <head>
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src https://code.jquery.com https://cdn.jsdelivr.net https://www.google-analytics.com https://www.googletagmanager.com 'unsafe-inline' 'self'; style-src https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com 'self'; font-src https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com https://fonts.googleapis.com; object-src 'none'">
   <script async src="https://www.googletagmanager.com/gtag/js?id=UA-113065209-1"></script>
   <script>
     window.dataLayer = window.dataLayer || [];
diff --git a/www/index.html b/www/index.html
index 9a344c8..627bc5c 100644
--- a/www/index.html
+++ b/www/index.html
@@ -1,6 +1,7 @@
 <!DOCTYPE html>
 <html>
 <head>
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src https://code.jquery.com https://cdn.jsdelivr.net https://www.google-analytics.com https://www.googletagmanager.com 'unsafe-inline' 'self'; style-src https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com 'self'; font-src https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com https://fonts.googleapis.com; object-src 'none'">
   <script async src="https://www.googletagmanager.com/gtag/js?id=UA-113065209-1"></script>
   <script>
     window.dataLayer = window.dataLayer || [];
diff --git a/www/past.html b/www/past.html
index 2660d5e..8e68902 100644
--- a/www/past.html
+++ b/www/past.html
@@ -1,6 +1,7 @@
 <!DOCTYPE html>
 <html>
 <head>
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src https://code.jquery.com https://cdn.jsdelivr.net https://www.google-analytics.com https://www.googletagmanager.com 'unsafe-inline' 'self'; style-src https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com 'self'; font-src https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com https://fonts.googleapis.com; object-src 'none'">
   <script async src="https://www.googletagmanager.com/gtag/js?id=UA-113065209-1"></script>
   <script>
     window.dataLayer = window.dataLayer || [];
