diff --git a/src/BCards.Web/Program.cs b/src/BCards.Web/Program.cs
index 1cd1aa5..6200460 100644
--- a/src/BCards.Web/Program.cs
+++ b/src/BCards.Web/Program.cs
@@ -581,7 +581,10 @@ builder.Services.AddHsts(options =>
 
 var app = builder.Build();
 
-app.UseForwardedHeaders();
+app.UseForwardedHeaders(new ForwardedHeadersOptions
+{
+    ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
+});
 
 if (!app.Environment.IsDevelopment())
 {
@@ -607,6 +610,19 @@ app.Use(async (context, next) =>
     context.Response.Headers.Append("Referrer-Policy", "no-referrer");
     context.Response.Headers.Append("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
 
+    // Content Security Policy - Protects against XSS attacks
+    var csp = "default-src 'self'; " +
+              "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://code.jquery.com https://cdn.jsdelivr.net/npm/bootstrap@5.3.2 https://accounts.google.com https://apis.google.com; " +
+              "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com https://cdn.jsdelivr.net/npm/bootstrap@5.3.2; " +
+              "img-src 'self' data: https: blob:; " +
+              "font-src 'self' https://fonts.gstatic.com https://cdn.jsdelivr.net; " +
+              "connect-src 'self' https://accounts.google.com https://apis.google.com https://login.microsoftonline.com; " +
+              "frame-src 'self' https://accounts.google.com https://login.microsoftonline.com; " +
+              "object-src 'none'; " +
+              "base-uri 'self'; " +
+              "form-action 'self'";
+    context.Response.Headers.Append("Content-Security-Policy", csp);
+
     // Load balancer e debugging headers
     context.Response.Headers.Append("X-Server-ID", Environment.MachineName);
     context.Response.Headers.Append("X-Instance-ID", $"{Environment.MachineName}-{Environment.ProcessId}");