diff --git a/.rubocop.yml b/.rubocop.yml
index e169f08..6584010 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -30,7 +30,7 @@ Metrics/MethodLength:
     - "lib/volumen/api_routes.rb"
 
 Metrics/ClassLength:
-  Max: 400
+  Max: 420
 
 Metrics/ModuleLength:
   Exclude:
diff --git a/lib/volumen/server.rb b/lib/volumen/server.rb
index e725978..dc83dc7 100644
--- a/lib/volumen/server.rb
+++ b/lib/volumen/server.rb
@@ -64,6 +64,19 @@ module Volumen
     before do
       options = request.env["rack.session.options"]
       options[:secure] = request.ssl? if options
+
+      if request.path_info.start_with?("/admin")
+        headers "Content-Security-Policy" => [
+          "default-src 'self'",
+          "script-src 'self' 'unsafe-inline'",
+          "style-src 'self' 'unsafe-inline'",
+          "img-src 'self' data:",
+          "font-src 'self'",
+          "connect-src 'self'",
+          "form-action 'self'",
+          "frame-ancestors 'none'"
+        ].join("; ")
+      end
     end
 
     private