diff --git a/docs/nginx_photos b/docs/nginx_photos
index 51f5fb3..19b0154 100644
--- a/docs/nginx_photos
+++ b/docs/nginx_photos
@@ -38,7 +38,6 @@ server {
     client_max_body_size 2G;
 
     add_header "X-XSS-Protection" "1; mode=block";
-    add_header "Content-Security-Policy" "default-src 'self' 'unsafe-inline';";
 
     # Django statics and media
     # Do not directly serve media, it must be authorized
diff --git a/photo21/templates/base.html b/photo21/templates/base.html
index ff7070a..b5062b6 100644
--- a/photo21/templates/base.html
+++ b/photo21/templates/base.html
@@ -8,6 +8,8 @@ SPDX-License-Identifier: GPL-3.0-or-later
 <head>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'self'; frame-ancestors 'none'">
+    <meta http-equiv="Referrer-Policy" content="no-referrer">
     <title>{% block title %}{{ title }}{% endblock title %} - {{ request.site.name }}</title>
     <meta name="description" content="{% trans "The ENS Paris-Saclay pictures server." %}">
     <link rel="stylesheet" href="{% static "bootstrap5/css/bootstrap.min.css" %}">
