diff --git a/ChangeLog b/ChangeLog
index 06d98cba0..40fa43ba8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -80,6 +80,7 @@ $Id$
 + rfe #2983207, patch #2988715 [interface] Use jQuery calendar dialog, thanks
   to Muhammad Adnan.
 + [doc] Incorporate synchronisation docs into main document.
++ [core] Include Content Security Policy HTTP headers.
 
 3.3.3.0 (not yet released)
 - patch #2982480 [navi] Do not group if there would be one table in group,
diff --git a/libraries/header_http.inc.php b/libraries/header_http.inc.php
index 2a1c44564..46f8017be 100644
--- a/libraries/header_http.inc.php
+++ b/libraries/header_http.inc.php
@@ -23,6 +23,7 @@ $GLOBALS['now'] = gmdate('D, d M Y H:i:s') . ' GMT';
 /* Prevent against ClickJacking by allowing frames only from same origin */
 if (!$GLOBALS['cfg']['AllowThirdPartyFraming']) {
     header('X-Frame-Options: SAMEORIGIN');
+    header('X-Content-Security-Policy: allow \'self\'; options inline-script eval-script; frame-ancestors \'self\'');
 }
 header('Expires: ' . $GLOBALS['now']); // rfc2616 - Section 14.21
 header('Last-Modified: ' . $GLOBALS['now']);