diff --git a/index.php b/index.php
index 9d3346ab..2e1903be 100755
--- a/index.php
+++ b/index.php
@@ -9,6 +9,22 @@
     <title>OpenFlights.org: <?php echo _("Flight logging, mapping, stats and sharing") ?></title>
     <meta name="description" content="Free open-source tool for logging, mapping, calculating and sharing your flights and trips.">
     <meta name="keywords" content="flight,memory,logging,mapping,statistics,sharing">
+	<meta http-equiv="Content-Security-Policy" content="default-src 'none' ;
+	    font-src 'self' fonts.googleapis.com
+	                    fonts.gstatic.com ;
+	    img-src 'self' data: cartodb-basemaps-1.global.ssl.fastly.net
+	                    stamen-tiles.a.fastly.net
+	                    api.tiles.mapbox.com
+	                    www.googletagmanager.com www.google-analytics.com;
+	    style-src 'self' 'unsafe-inline' www.googletagmanager.com www.google-analytics.com
+	                    www.gstatic.com fonts.googleapis.com ;
+	    script-src      'self' 'unsafe-inline' www.googletagmanager.com www.google-analytics.com
+	                    www.google.com/jsapi www.gstatic.com ;
+        connect-src     'self' www.google-analytics.com;
+	    child-src 'none' ;
+	    object-src 'none' ;
+        upgrade-insecure-requests;
+        block-all-mixed-content; ;">
     <link rel="stylesheet" href="/css/style_reset.css" type="text/css">
     <link rel="stylesheet" href="<?php echo fileUrlWithDate("/openflights.css") ?>" type="text/css">
     <link rel="gettext" type="application/x-po" href="/locale/<?php echo $locale?>/LC_MESSAGES/messages.po?20090715" />
diff --git a/php/locale.php b/php/locale.php
index 9104b5c7..11d000cf 100644
--- a/php/locale.php
+++ b/php/locale.php
@@ -1,4 +1,5 @@
 <?php
+session_set_cookie_params(['samesite' => 'Strict']);
 session_start();
 include 'config.php';