diff --git a/site/config/config.php b/site/config/config.php
index 4b1fe15..17d1dc1 100644
--- a/site/config/config.php
+++ b/site/config/config.php
@@ -1,5 +1,4 @@
 <?php
-header("Content-Security-Policy: default-src 'self'; style-src 'self' 'nonce-nRfqpuKWNuYyUAFPTr6WVNZk9' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; frame-src https://www.youtube-nocookie.com; script-src 'self' 'nonce-nRfqpuKWNuYyUAFPTr6WVNZk9' https://jannikb.aquila.uberspace.de/piwik/; img-src 'self' https://jannikb.aquila.uberspace.de/piwik/");
 //header("X-Content-Type-Options: nosniff");  // enabled at server-side
 //header("X-Frame-Options: deny");            // enabled at server-side
 //header("X-Xss-Protection: 1; mode=block");  // enabled at server-side
diff --git a/site/snippets/base/html-head.php b/site/snippets/base/html-head.php
index 4861a6e..2c02ddf 100644
--- a/site/snippets/base/html-head.php
+++ b/site/snippets/base/html-head.php
@@ -5,6 +5,7 @@
 // copyright: Jannik Beyerstedt | https://jannikbeyerstedt.de
 // license: http://www.gnu.org/licenses/gpl-3.0.txt GPLv3 License
 // -------------------------------------------
+header("Content-Security-Policy: default-src 'self'; style-src 'self' 'nonce-nRfqpuKWNuYyUAFPTr6WVNZk9' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; frame-src https://www.youtube-nocookie.com; script-src 'self' 'nonce-nRfqpuKWNuYyUAFPTr6WVNZk9' https://jannikb.aquila.uberspace.de/piwik/; img-src 'self' https://jannikb.aquila.uberspace.de/piwik/");
 
 if( $page->isHomePage() ) {
   $title = $site->title()->html();