diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf
index 349be9177..9bdbb0f26 100644
--- a/data/templates/nginx/plain/yunohost_admin.conf
+++ b/data/templates/nginx/plain/yunohost_admin.conf
@@ -38,7 +38,8 @@ server {
     #ssl_dhparam /etc/ssl/private/dh2048.pem;
     
     add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; 
-    add_header 'Referrer-Policy' 'no-referrer';
+    add_header 'Referrer-Policy' 'origin-when-cross-origin';
+    add_header Content-Security-Policy "upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval';report-uri /csp-violation-report-endpoint/";
     add_header X-Content-Type-Options nosniff;
     add_header X-XSS-Protection "1; mode=block";
     add_header X-Download-Options noopen;