diff --git a/internal/web/security.go b/internal/web/security.go
new file mode 100644
index 0000000..b2eb1d4
--- /dev/null
+++ b/internal/web/security.go
@@ -0,0 +1,126 @@
+package web
+
+import (
+	"net/http"
+	"net/url"
+)
+
+// contentSecurityPolicy is the panel's CSP. Everything the pages load —
+// stylesheet, HTMX, the panel's own script, the favicon — is served from
+// /static by this same origin, and no template carries an inline <script>,
+// an inline event handler or a style="..." attribute (phase 14.A; the
+// template guard test enforces that), so 'self' needs no exemptions:
+//
+//   - default-src 'self' covers scripts, styles, images and the XHR that
+//     HTMX's polling fragments use;
+//   - object-src/frame-ancestors 'none' remove plugin embedding and framing
+//     (clickjacking) outright;
+//   - base-uri 'none' stops an injected <base> from re-pointing every
+//     relative URL on the page, including the form actions;
+//   - form-action 'self' keeps a form from being retargeted at another host.
+//
+// This is a second line of defence: XSS is already prevented by
+// html/template's contextual auto-escaping (spec 7.6.7).
+const contentSecurityPolicy = "default-src 'self'; " +
+	"object-src 'none'; " +
+	"base-uri 'none'; " +
+	"form-action 'self'; " +
+	"frame-ancestors 'none'"
+
+// strictTransportSecurity is sent only when the deployment is HTTPS-only
+// (CookieSecure, the same condition that gates the cookie's Secure attribute):
+// on the plain-HTTP development setup it would be meaningless at best and
+// would pin the browser to a scheme the dev instance does not speak at worst.
+//
+// Deliberately without includeSubDomains. The panel commonly lives on a
+// subdomain of a domain used for other things, but it may also sit at the
+// apex — and there the directive would force HTTPS on every unrelated
+// subdomain of that domain for a year, which is not SelfPost's call to make.
+const strictTransportSecurity = "max-age=31536000"
+
+// secure wraps the whole router with the panel's two transport-level defences
+// (phase 14.A): the security response headers, and an origin check on every
+// state-changing request.
+//
+// It sits outside the authentication middleware on purpose, so that POST
+// /login and POST /setup/{token} are covered too.
+func (s *Server) secure(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		h := w.Header()
+		h.Set("Content-Security-Policy", contentSecurityPolicy)
+		h.Set("X-Content-Type-Options", "nosniff")
+		// Equivalent to the CSP's frame-ancestors directive, kept for browsers
+		// that predate it. The two never disagree: both mean "never framed".
+		h.Set("X-Frame-Options", "DENY")
+		// The panel's behaviour never depends on the referrer, so the strictest
+		// value is free: panel URLs carry domain names and record identifiers
+		// that need not leak to anything the administrator clicks through to.
+		h.Set("Referrer-Policy", "no-referrer")
+		if s.cfg.CookieSecure {
+			h.Set("Strict-Transport-Security", strictTransportSecurity)
+		}
+
+		if !originAllowed(r) {
+			// Log both sides of the comparison. The check depends on r.Host
+			// being the name the browser actually used, which every reverse
+			// proxy fragment this project ships preserves (Apache
+			// ProxyPreserveHost On, nginx proxy_set_header Host $host, Caddy
+			// and Traefik by default) — but a proxy that rewrites Host turns
+			// every form submission into a 403, and without these two values
+			// side by side the symptom just looks like "the panel stopped
+			// saving anything".
+			logf("panel: rejected %s %s: cross-origin request (Sec-Fetch-Site=%q Origin=%q Host=%q); "+
+				"if this was a legitimate request, check that the reverse proxy passes the original Host header through",
+				r.Method, r.URL.Path, r.Header.Get("Sec-Fetch-Site"), r.Header.Get("Origin"), r.Host)
+			http.Error(w, "cross-origin request rejected", http.StatusForbidden)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+// originAllowed reports whether a state-changing request came from the panel's
+// own origin (phase 14.A). This is what the session cookie's
+// SameSite=Lax attribute cannot do on its own: SameSite is judged per *site*
+// (registrable domain), so a neighbouring subdomain — a CMS on the same
+// domain, a forgotten staging host — counts as same-site and its forged POST
+// would arrive with the session cookie attached. Sec-Fetch-Site and Origin are
+// judged per *origin*, so they tell that neighbour apart from the panel.
+//
+// Read-only methods are exempt: every GET route in the panel is a read (the
+// delete confirmation at GET /domains/{id}/delete only renders a form), so
+// there is nothing for a cross-origin GET to change.
+func originAllowed(r *http.Request) bool {
+	switch r.Method {
+	case http.MethodGet, http.MethodHead, http.MethodOptions:
+		return true
+	}
+
+	// The browser's own account of where the request came from. It cannot be
+	// set by page script (a forbidden header name), so when it is present it
+	// is the answer: anything but same-origin — including "none", a
+	// navigation with no initiator — is refused.
+	if site := r.Header.Get("Sec-Fetch-Site"); site != "" {
+		return site == "same-origin"
+	}
+
+	// Older browsers send only Origin. Compare hosts, not full origins: the
+	// panel speaks plain HTTP behind the proxy and does not know its own
+	// external scheme, while Origin will say https.
+	origin := r.Header.Get("Origin")
+	if origin == "" {
+		// Neither header. A client this old cannot be checked at all; it is
+		// let through as the risk consciously accepted for phase 14.A
+		// (single-admin panel, the administrator picks the browser). Turning
+		// this return into false is the whole of the stricter policy.
+		return true
+	}
+	u, err := url.Parse(origin)
+	if err != nil || u.Host == "" {
+		// Unparseable, or the opaque "null" origin (sandboxed iframe,
+		// redirected cross-origin POST) — not this panel either way.
+		return false
+	}
+	return u.Host == r.Host
+}
diff --git a/internal/web/security_test.go b/internal/web/security_test.go
new file mode 100644
index 0000000..ce45a54
--- /dev/null
+++ b/internal/web/security_test.go
@@ -0,0 +1,129 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// serveSecured runs one request through the security middleware and reports
+// what came out. The wrapped handler answers 200, so any other status is the
+// middleware's doing.
+func serveSecured(cookieSecure bool, r *http.Request) *httptest.ResponseRecorder {
+	s := &Server{cfg: Config{CookieSecure: cookieSecure}}
+	h := s.secure(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, r)
+	return rec
+}
+
+// post builds a request as a browser would send it to the panel's own host.
+func post(secFetchSite, origin string) *http.Request {
+	r := httptest.NewRequest(http.MethodPost, "http://panel.example.com/domains", nil)
+	r.Host = "panel.example.com"
+	if secFetchSite != "" {
+		r.Header.Set("Sec-Fetch-Site", secFetchSite)
+	}
+	if origin != "" {
+		r.Header.Set("Origin", origin)
+	}
+	return r
+}
+
+// The full matrix the origin check has to get right (phase 14.A). The row that
+// matters most is "same-site": a neighbouring host on example.com is same-site
+// as far as the session cookie's SameSite=Lax is concerned, so this check is
+// the only thing standing between it and a forged POST.
+func TestOriginCheck(t *testing.T) {
+	tests := []struct {
+		name         string
+		req          *http.Request
+		wantRejected bool
+	}{
+		{"no headers at all is let through (accepted risk)", post("", ""), false},
+		{"same-origin", post("same-origin", "https://panel.example.com"), false},
+		{"same-site, i.e. a neighbouring subdomain", post("same-site", ""), true},
+		{"cross-site", post("cross-site", "https://evil.example.net"), true},
+		{"none, a navigation with no initiator", post("none", ""), true},
+		{"Sec-Fetch-Site outranks a matching Origin", post("cross-site", "https://panel.example.com"), true},
+		{"Origin host matches", post("", "https://panel.example.com"), false},
+		{"Origin host differs", post("", "https://evil.example.net"), true},
+		{"Origin differs from a neighbour only in host", post("", "https://cms.example.com"), true},
+		{"opaque null Origin", post("", "null"), true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			rec := serveSecured(true, tc.req)
+			rejected := rec.Code == http.StatusForbidden
+			if rejected != tc.wantRejected {
+				t.Fatalf("status = %d, rejected = %t, want rejected = %t", rec.Code, rejected, tc.wantRejected)
+			}
+		})
+	}
+}
+
+// The proxy terminates TLS and forwards plain HTTP, so the panel never learns
+// its own external scheme: comparing it against the https in Origin would
+// reject every legitimate form submission in the documented deployment.
+func TestOriginCheckIgnoresScheme(t *testing.T) {
+	rec := serveSecured(true, post("", "https://panel.example.com"))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200: an https Origin against a plain-HTTP panel must pass", rec.Code)
+	}
+}
+
+// Every GET route in the panel is a read, so cross-origin reads have nothing
+// to change and must not be blocked — the HTMX polling fragments included.
+func TestOriginCheckExemptsReads(t *testing.T) {
+	for _, method := range []string{http.MethodGet, http.MethodHead} {
+		r := httptest.NewRequest(method, "http://panel.example.com/status/fragment", nil)
+		r.Host = "panel.example.com"
+		r.Header.Set("Sec-Fetch-Site", "cross-site")
+		if rec := serveSecured(true, r); rec.Code != http.StatusOK {
+			t.Errorf("%s: status = %d, want 200", method, rec.Code)
+		}
+	}
+}
+
+func TestSecurityHeaders(t *testing.T) {
+	rec := serveSecured(true, httptest.NewRequest(http.MethodGet, "http://panel.example.com/status", nil))
+	want := map[string]string{
+		"Content-Security-Policy":   contentSecurityPolicy,
+		"X-Content-Type-Options":    "nosniff",
+		"X-Frame-Options":           "DENY",
+		"Referrer-Policy":           "no-referrer",
+		"Strict-Transport-Security": strictTransportSecurity,
+	}
+	for name, value := range want {
+		if got := rec.Header().Get(name); got != value {
+			t.Errorf("%s = %q, want %q", name, got, value)
+		}
+	}
+}
+
+// HSTS is the one header that must not be sent unconditionally: on the
+// plain-HTTP development instance it would pin the browser to a scheme that
+// instance does not speak.
+func TestHSTSOnlyWhenSecure(t *testing.T) {
+	rec := serveSecured(false, httptest.NewRequest(http.MethodGet, "http://panel.example.com/status", nil))
+	if got := rec.Header().Get("Strict-Transport-Security"); got != "" {
+		t.Errorf("Strict-Transport-Security = %q on a non-secure deployment, want none", got)
+	}
+	if got := rec.Header().Get("Content-Security-Policy"); got == "" {
+		t.Error("the other security headers must still be sent without TLS")
+	}
+}
+
+// A rejected request is still a response the browser renders, so it carries
+// the same headers as any other.
+func TestRejectedRequestKeepsSecurityHeaders(t *testing.T) {
+	rec := serveSecured(true, post("cross-site", ""))
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403", rec.Code)
+	}
+	if got := rec.Header().Get("Content-Security-Policy"); got != contentSecurityPolicy {
+		t.Errorf("Content-Security-Policy = %q on the 403 response, want the policy", got)
+	}
+}
diff --git a/internal/web/web.go b/internal/web/web.go
index 7c27d1d..a124560 100644
--- a/internal/web/web.go
+++ b/internal/web/web.go
@@ -181,7 +181,9 @@ func (s *Server) Handler() http.Handler {
 
 	mux.Handle("/", s.requireAuth(authed))
 
-	return mux
+	// Security headers and the origin check wrap everything, including the
+	// unauthenticated login and setup routes (phase 14.A).
+	return s.secure(mux)
 }
 
 // redirectToStatus points the panel root at the status page, so there is one