diff --git a/config b/config
index 98e13af2..b2bddd5b 100644
--- a/config
+++ b/config
@@ -431,6 +431,9 @@
 # Additional HTTP headers
 #Access-Control-Allow-Origin = *
 
+# Set CSP to disallow execution of unknown javascript
+# This may become the default in future versions, override if you need a different CSP.
+Content-Security-Policy = default-src 'self'; object-src 'none'
 
 [hook]
 
diff --git a/integ_tests/common.py b/integ_tests/common.py
index ca1527f3..06a6a4a3 100644
--- a/integ_tests/common.py
+++ b/integ_tests/common.py
@@ -53,6 +53,8 @@ type = htpasswd
 htpasswd_filename = {user_path}
 [web]
 type = internal
+[headers]
+Content-Security-Policy = default-src 'self'; object-src 'none'
 [sharing]
 type = csv
 collection_by_map = true
diff --git a/radicale/httputils.py b/radicale/httputils.py
index ddad1eac..424f178e 100644
--- a/radicale/httputils.py
+++ b/radicale/httputils.py
@@ -200,7 +200,6 @@ def _serve_traversable(
         os.path.splitext(traversable.name)[1].lower(), FALLBACK_MIMETYPE)
     headers = {
         "Content-Type": content_type,
-        "Content-Security-Policy": "default-src 'self'; object-src 'none'"
     }
     if isinstance(traversable, pathlib.Path):
         headers["Last-Modified"] = time.strftime(