diff --git a/plugins/graphql/package.json b/plugins/graphql/package.json
index f98c21f2c7..6f8ff50c1a 100644
--- a/plugins/graphql/package.json
+++ b/plugins/graphql/package.json
@@ -29,6 +29,7 @@
     "express": "^4.17.1",
     "express-promise-router": "^3.0.3",
     "graphql": "^15.3.0",
+    "helmet": "^4.0.0",
     "node-fetch": "^2.6.0",
     "reflect-metadata": "^0.1.13",
     "winston": "^3.2.1",
diff --git a/plugins/graphql/src/service/router.ts b/plugins/graphql/src/service/router.ts
index 784b801b86..cd926da3a2 100644
--- a/plugins/graphql/src/service/router.ts
+++ b/plugins/graphql/src/service/router.ts
@@ -24,6 +24,7 @@ import { GraphQLModule } from '@graphql-modules/core';
 import { ApolloServer } from 'apollo-server-express';
 import { createModule as createCatalogModule } from '@backstage/plugin-catalog-graphql';
 import { Config } from '@backstage/config';
+import helmet from 'helmet';
 
 const schemaPath = path.resolve(
   require.resolve('@backstage/plugin-graphql-backend/package.json'),
@@ -41,15 +42,29 @@ export async function createRouter(
   const typeDefs = await fs.promises.readFile(schemaPath, 'utf-8');
 
   const catalogModule = await createCatalogModule(options);
+
   const { schema } = new GraphQLModule({
     imports: [catalogModule],
     typeDefs,
   });
 
-  const server = new ApolloServer({ schema, logger: options.logger });
+  const server = new ApolloServer({
+    schema,
+    logger: options.logger,
+  });
+
   const router = Router();
 
   const apolloMiddlware = server.getMiddleware({ path: '/' });
+
+  router.use(
+    helmet.contentSecurityPolicy({
+      directives: {
+        defaultSrc: ["'self'", "'unsafe-inline'", 'http://*'],
+      },
+    }),
+  );
+
   router.use(apolloMiddlware);
 
   router.get('/health', (_, response) => {