diff --git a/conf/nginx.conf b/conf/nginx.conf
index e97c789..5096c28 100644
--- a/conf/nginx.conf
+++ b/conf/nginx.conf
@@ -1,4 +1,3 @@
-
 location / {
         include __FINALPATH__/code/deploy/funkwhale_proxy.conf;
         # this is needed if you have file import via upload enabled
@@ -17,8 +16,14 @@ location /front/ {
 }
 
 location /front/embed.html {
-	more_set_headers X-Frame-Options "ALLOW";
+	add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:";
+    add_header Referrer-Policy "strict-origin-when-cross-origin";
+	add_header X-Frame-Options "ALLOW";
 	alias __FINALPATH__/code/front/dist/embed.html;
+	expires 30d;
+    add_header Pragma public;
+    add_header Cache-Control "public, must-revalidate, proxy-revalidate";
+
 }
 
 location /federation/ {