diff --git a/templates/base.html.twig b/templates/base.html.twig
index 30d0b11327..13d408355f 100644
--- a/templates/base.html.twig
+++ b/templates/base.html.twig
@@ -2,6 +2,8 @@
 <html lang="en">
 <head>
     {% block meta %}
+        {# This is far from perfect. The response headers should already come with this. #}
+        {% if app.request.server.get('APP_ENV') not in ['test', 'dev'] %}<meta http-equiv="Content-Security-Policy" content="default-src https:">{% endif %}
         <meta charset="utf-8">
         <meta name="viewport" content="width=device-width, initial-scale=1">
         <link rel="home" href="/">
