diff --git a/dev/demo/plugin-server.html b/dev/demo/plugin-server.html
index f513b46..21362fd 100644
--- a/dev/demo/plugin-server.html
+++ b/dev/demo/plugin-server.html
@@ -3,6 +3,10 @@
   <head>
     <title>Plugin demo</title>
     <link type="text/css" rel="stylesheet" href="/css/kalamar.css" />
+    <!--
+        see https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src https://*; child-src 'none';">
+-->
     <script data-main="/demo/plugin-serverdemo.js" src="/js/lib/require.js" async="async"></script>
   </head>
   <body>