diff --git a/files/templates/authforms.html b/files/templates/authforms.html
index 22462e092..975f39571 100644
--- a/files/templates/authforms.html
+++ b/files/templates/authforms.html
@@ -5,7 +5,7 @@
 	{% include "analytics.html" %}
 	
 	<meta name="description" content="{{config('DESCRIPTION')}}">
-		<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+		{% include "csp.html" %}
 
 		<meta charset="utf-8">
 		<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
diff --git a/files/templates/chat.html b/files/templates/chat.html
index c5276951a..abf8785bc 100644
--- a/files/templates/chat.html
+++ b/files/templates/chat.html
@@ -4,7 +4,7 @@
 	{% include "analytics.html" %}
 	
 	<meta name="description" content="{{config('DESCRIPTION')}}">
-	<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+	{% include "csp.html" %}
 
 	<meta charset="utf-8">
 	<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
diff --git a/files/templates/csp.html b/files/templates/csp.html
new file mode 100644
index 000000000..6f3f00bd9
--- /dev/null
+++ b/files/templates/csp.html
@@ -0,0 +1 @@
+<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self' *.google-analytics.com *.analytics.google.com; object-src 'none'; img-src 'self' *.google-analytics.com *.analytics.google.com">
diff --git a/files/templates/default.html b/files/templates/default.html
index 63ad50a8b..5d25955ea 100644
--- a/files/templates/default.html
+++ b/files/templates/default.html
@@ -5,7 +5,7 @@
 	
 	<link rel="alternate" type="application/rss+xml" title="The Motte RSS" href="/rss">
 	<meta name="description" content="{{config('DESCRIPTION')}}">
-	<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline' 'unsafe-eval' ajax.cloudflare.com; connect-src 'self' tls-use1.fpapi.io api.fpjs.io {% if PUSHER_ID != 'blahblahblah' %}{{PUSHER_ID}}.pushnotifications.pusher.com{% endif %}; object-src 'none';">
+	{% include "csp.html" %}
 
 	<script src="{{ 'js/bootstrap.js' | asset }}"></script>
 	<script src="{{ 'js/micromodal.js' | asset }}"></script>
diff --git a/files/templates/login.html b/files/templates/login.html
index 7fef8f45c..16afba693 100644
--- a/files/templates/login.html
+++ b/files/templates/login.html
@@ -6,7 +6,7 @@
 	{% include "analytics.html" %}
 	
 	<meta name="description" content="{{config('DESCRIPTION')}}">
-	<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+	{% include "csp.html" %}
 
 	<script src="{{ 'js/bootstrap.js' | asset }}"></script>
 
diff --git a/files/templates/login_2fa.html b/files/templates/login_2fa.html
index 7568d639d..695f17473 100644
--- a/files/templates/login_2fa.html
+++ b/files/templates/login_2fa.html
@@ -6,7 +6,7 @@
 	{% include "analytics.html" %}
 	
 	<meta name="description" content="{{config('DESCRIPTION')}}">
-		<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+	{% include "csp.html" %}
 
 		<meta charset="utf-8">
 		<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
diff --git a/files/templates/settings.html b/files/templates/settings.html
index 646bc80c9..800a4b001 100644
--- a/files/templates/settings.html
+++ b/files/templates/settings.html
@@ -5,7 +5,7 @@
 	{% include "analytics.html" %}
 
 	<meta name="description" content="{{config('DESCRIPTION')}}">
-	<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+	{% include "csp.html" %}
 
 	<script src="{{ 'js/bootstrap.js' | asset }}"></script>
 
diff --git a/files/templates/sign_up.html b/files/templates/sign_up.html
index 57fd5bd1d..0b1839c13 100644
--- a/files/templates/sign_up.html
+++ b/files/templates/sign_up.html
@@ -5,7 +5,7 @@
 	{% include "analytics.html" %}
 	
 	<meta name="description" content="{{config('DESCRIPTION')}}">
-		<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+	{% include "csp.html" %}
 
 		<script src="{{ 'js/bootstrap.js' | asset }}"></script>
 
diff --git a/files/templates/sign_up_failed_ref.html b/files/templates/sign_up_failed_ref.html
index 6cf9f3f91..37dc49bfc 100644
--- a/files/templates/sign_up_failed_ref.html
+++ b/files/templates/sign_up_failed_ref.html
@@ -3,8 +3,10 @@
 <html lang="en">
 
 <head>
+	{% include "analytics.html" %}
+	
 	<meta name="description" content="{{config('DESCRIPTION')}}">
-		<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+	{% include "csp.html" %}
 
 		<script src="{{ 'js/bootstrap.js' | asset }}"></script>
 
diff --git a/files/templates/submit.html b/files/templates/submit.html
index 7d240bec0..f680b5100 100644
--- a/files/templates/submit.html
+++ b/files/templates/submit.html
@@ -4,7 +4,7 @@
 	{% include "analytics.html" %}
 	
 	<meta name="description" content="{{config('DESCRIPTION')}}">
-		<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none';">
+	{% include "csp.html" %}
 
 		<script src="{{ 'js/bootstrap.js' | asset }}"></script>