diff --git a/gui/app/index.html b/gui/app/index.html
index edf0e556..69a82801 100644
--- a/gui/app/index.html
+++ b/gui/app/index.html
@@ -4,6 +4,7 @@
 		{{content-for 'head'}}
 		<meta charset="utf-8">
 		<meta http-equiv="X-UA-Compatible" content="IE=edge">
+		<meta http-equiv=content-security-policy content="default-src *; img-src * 'self' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; style-src 'self' 'unsafe-inline' *;">
 		<title>Documize</title>
 		<meta property="dbname" content="{{.DBname}}" />
 		<meta property="dbhash" content="{{.DBhash}}" />
diff --git a/server/middleware.go b/server/middleware.go
index fc6b3ece..63b3bf19 100644
--- a/server/middleware.go
+++ b/server/middleware.go
@@ -253,6 +253,7 @@ func (m *middleware) preAuthorizeStaticAssets(rt *env.Runtime, r *http.Request)
 		strings.ToLower(r.URL.Path) == "/validate" ||
 		strings.ToLower(r.URL.Path) == "/favicon.ico" ||
 		strings.ToLower(r.URL.Path) == "/robots.txt" ||
+		strings.ToLower(r.URL.Path) == "/sitemap.xml" ||
 		strings.ToLower(r.URL.Path) == "/version" ||
 		strings.HasPrefix(strings.ToLower(r.URL.Path), "/api/public/") ||
 		((rt.Flags.SiteMode == env.SiteModeSetup) && (strings.ToLower(r.URL.Path) == "/api/setup")) {