diff --git a/src/index.html b/src/index.html
index 1533f33a83..b391c097b9 100644
--- a/src/index.html
+++ b/src/index.html
@@ -2,6 +2,36 @@
 <html ng-app="bit">
 <head>
     <meta charset="utf-8" />
+    <meta http-equiv="Content-Security-Policy" content="
+          default-src
+            'self';
+          script-src
+            'self'
+            https://www.google-analytics.com
+            https://js.stripe.com
+            https://maxcdn.bootstrapcdn.com
+            https://ajax.googleapis.com;
+          style-src
+            'self'
+            'unsafe-inline'
+            https://maxcdn.bootstrapcdn.com
+            https://fonts.googleapis.com;
+          img-src
+            'self'
+            data:
+            https://q.stripe.com
+            https://haveibeenpwned.com
+            https://chart.googleapis.com
+            https://www.google-analytics.com;
+          font-src
+            'self'
+            https://maxcdn.bootstrapcdn.com
+            https://fonts.gstatic.com;
+          frame-src
+            'self'
+            https://js.stripe.com;
+          connect-src
+            *;">
     <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" />
     <base href="/" />
 
@@ -9,11 +39,11 @@
 
     <script src="https://js.stripe.com/v2/"></script>
     <!-- @if true !>
-    <link rel="stylesheet" href="//maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" />
+    <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" />
     <meta name="x-stylesheet-test-bs" content="" class="invisible" />
     <script>!function(a,b,c){var d,e=document,f=e.getElementsByTagName('SCRIPT'),g=f[f.length-1].previousElementSibling,h=e.defaultView&&e.defaultView.getComputedStyle?e.defaultView.getComputedStyle(g):g.currentStyle;if(h&&h[a]!==b)for(d=0;d<c.length;d++)e.write('<link rel="stylesheet" href="'+c[d]+'"/>')}('visibility','hidden',['lib\/bootstrap\/css\/bootstrap.min.css?v=<!-- @echo cacheTag !>']);</script>
 
-    <link rel="stylesheet" href="//maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css" />
+    <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css" />
     <meta name="x-stylesheet-test-fa" content="" class="fa" />
     <script>!function(a,b,c){var d,e=document,f=e.getElementsByTagName('SCRIPT'),g=f[f.length-1].previousElementSibling,h=e.defaultView&&e.defaultView.getComputedStyle?e.defaultView.getComputedStyle(g):g.currentStyle;if(h&&h[a]!==b)for(d=0;d<c.length;d++)e.write('<link rel="stylesheet" href="'+c[d]+'"/>')}('font-family','FontAwesome',['lib\/font-awesome\/css\/font-awesome.min.css?v=<!-- @echo cacheTag !>']);</script>
 
@@ -27,32 +57,23 @@
     <!-- @endexclude -->
 </head>
 <body ng-controller="mainController as main" class="layout-boxed skin-blue sidebar-mini {{main.bodyClass}}"
-      ng-class="{'using-control-sidebar': main.usingControlSidebar, 
+      ng-class="{'using-control-sidebar': main.usingControlSidebar,
       'control-sidebar-open': main.usingControlSidebar && main.openControlSidebar}">
     <div ui-view></div>
 
     <!-- @if true !>
-    <script src="//ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
+    <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
     <script>(window.jQuery||document.write('<script src="lib\/jquery\/jquery.min.js?v=<!-- @echo cacheTag !>"><\/script>'));</script>
 
-    <script src="//maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js"></script>
+    <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js"></script>
     <script>((window.jQuery&&window.jQuery.fn&&window.jQuery.fn.modal)||document.write('<script src="lib\/bootstrap\/js\/bootstrap.min.js?v=<!-- @echo cacheTag !>"><\/script>'));</script>
 
-    <script src="//ajax.googleapis.com/ajax/libs/angularjs/1.6.3/angular.min.js"></script>
+    <script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.6.3/angular.min.js"></script>
     <script>(window.angular||document.write('<script src="lib\/angular\/angular.min.js?v=<!-- @echo cacheTag !>"><\/script>'));</script>
 
     <script src="js/lib.min.js?v=<!-- @echo cacheTag !>"></script>
     <script src="js/bw.min.js?v=<!-- @echo cacheTag"></script>
     <script src="js/app.min.js?v=<!-- @echo cacheTag !>"></script>
-
-    <script>
-        (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
-        (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
-        m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
-        })(window,document,'script','https://www.google-analytics.com/analytics.js','ga');
-
-        ga('create', 'UA-81915606-3', 'auto');
-    </script>
     <!-- @endif -->
     <!-- @exclude -->
     <script src="lib/jquery/jquery.js"></script>
diff --git a/src/js/analytics.js b/src/js/analytics.js
new file mode 100644
index 0000000000..fcad7e6762
--- /dev/null
+++ b/src/js/analytics.js
@@ -0,0 +1,8 @@
+﻿(function (i, s, o, g, r, a, m) {
+    i['GoogleAnalyticsObject'] = r; i[r] = i[r] || function () {
+        (i[r].q = i[r].q || []).push(arguments)
+    }, i[r].l = 1 * new Date(); a = s.createElement(o),
+        m = s.getElementsByTagName(o)[0]; a.async = 1; a.src = g; m.parentNode.insertBefore(a, m)
+})(window, document, 'script', 'https://www.google-analytics.com/analytics.js', 'ga');
+
+ga('create', 'UA-81915606-3', 'auto');
