diff --git a/conf/nginx.conf b/conf/nginx.conf
index e97c789..5096c28 100644
--- a/conf/nginx.conf
+++ b/conf/nginx.conf
@@ -1,4 +1,3 @@
-
 location / {
         include __FINALPATH__/code/deploy/funkwhale_proxy.conf;
         # this is needed if you have file import via upload enabled
@@ -17,8 +16,14 @@ location /front/ {
 }
 
 location /front/embed.html {
-	more_set_headers X-Frame-Options "ALLOW";
+	add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:";
+    add_header Referrer-Policy "strict-origin-when-cross-origin";
+	add_header X-Frame-Options "ALLOW";
 	alias __FINALPATH__/code/front/dist/embed.html;
+	expires 30d;
+    add_header Pragma public;
+    add_header Cache-Control "public, must-revalidate, proxy-revalidate";
+
 }
 
 location /federation/ {
diff --git a/manifest.json b/manifest.json
index 7989a4a..c3ce4c9 100644
--- a/manifest.json
+++ b/manifest.json
@@ -5,7 +5,7 @@
 	"description": {
 		"en": "A modern, convivial and free music server"
 	},
-	"version": "0.20.1~ynh6",
+	"version": "0.21~ynh6",
 	"url": "https://funkwhale.audio",
 	"license": "AGPL-3.0-or-later",
 	"maintainer": {