diff --git a/shopware/core/6.4/public/.htaccess.dist b/shopware/core/6.4/public/.htaccess.dist
index 62601e58..bf323130 100644
--- a/shopware/core/6.4/public/.htaccess.dist
+++ b/shopware/core/6.4/public/.htaccess.dist
@@ -20,6 +20,10 @@ DirectoryIndex index.php
     RewriteCond %{ENV:REDIRECT_STATUS} ^$
     RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 
+    # Restrict stored HTML without affecting responses rendered by the application.
+    RewriteCond %{REQUEST_FILENAME} -f
+    RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
+
     # If the requested filename exists, simply serve it.
     # We only want to let Apache serve files and not directories.
     RewriteCond %{REQUEST_FILENAME} -f
@@ -36,8 +40,10 @@ DirectoryIndex index.php
 </IfModule>
 
 <IfModule mod_headers.c>
+    Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
+
     <FilesMatch "\.(?i:svg)$">
-        Header set Content-Security-Policy "script-src 'none'"
+        Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
     </FilesMatch>
 </IfModule>
 
diff --git a/shopware/core/6.6/public/.htaccess.dist b/shopware/core/6.6/public/.htaccess.dist
index 62601e58..bf323130 100644
--- a/shopware/core/6.6/public/.htaccess.dist
+++ b/shopware/core/6.6/public/.htaccess.dist
@@ -20,6 +20,10 @@ DirectoryIndex index.php
     RewriteCond %{ENV:REDIRECT_STATUS} ^$
     RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 
+    # Restrict stored HTML without affecting responses rendered by the application.
+    RewriteCond %{REQUEST_FILENAME} -f
+    RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
+
     # If the requested filename exists, simply serve it.
     # We only want to let Apache serve files and not directories.
     RewriteCond %{REQUEST_FILENAME} -f
@@ -36,8 +40,10 @@ DirectoryIndex index.php
 </IfModule>
 
 <IfModule mod_headers.c>
+    Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
+
     <FilesMatch "\.(?i:svg)$">
-        Header set Content-Security-Policy "script-src 'none'"
+        Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
     </FilesMatch>
 </IfModule>
 
diff --git a/shopware/core/6.7/public/.htaccess.dist b/shopware/core/6.7/public/.htaccess.dist
index 4984a302..3e64081a 100644
--- a/shopware/core/6.7/public/.htaccess.dist
+++ b/shopware/core/6.7/public/.htaccess.dist
@@ -20,6 +20,10 @@ DirectoryIndex index.php
     RewriteCond %{ENV:REDIRECT_STATUS} ^$
     RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 
+    # Restrict stored HTML without affecting responses rendered by the application.
+    RewriteCond %{REQUEST_FILENAME} -f
+    RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
+
     # If the requested filename exists, simply serve it.
     # We only want to let Apache serve files and not directories.
     RewriteCond %{REQUEST_FILENAME} -f
@@ -37,8 +41,10 @@ DirectoryIndex index.php
 </IfModule>
 
 <IfModule mod_headers.c>
+    Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
+
     <FilesMatch "\.(?i:svg)$">
-        Header set Content-Security-Policy "script-src 'none'"
+        Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
     </FilesMatch>
 </IfModule>
 
diff --git a/shopware/platform/6.4/public/.htaccess.dist b/shopware/platform/6.4/public/.htaccess.dist
index 62601e58..bf323130 100644
--- a/shopware/platform/6.4/public/.htaccess.dist
+++ b/shopware/platform/6.4/public/.htaccess.dist
@@ -20,6 +20,10 @@ DirectoryIndex index.php
     RewriteCond %{ENV:REDIRECT_STATUS} ^$
     RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 
+    # Restrict stored HTML without affecting responses rendered by the application.
+    RewriteCond %{REQUEST_FILENAME} -f
+    RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
+
     # If the requested filename exists, simply serve it.
     # We only want to let Apache serve files and not directories.
     RewriteCond %{REQUEST_FILENAME} -f
@@ -36,8 +40,10 @@ DirectoryIndex index.php
 </IfModule>
 
 <IfModule mod_headers.c>
+    Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
+
     <FilesMatch "\.(?i:svg)$">
-        Header set Content-Security-Policy "script-src 'none'"
+        Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
     </FilesMatch>
 </IfModule>
 
diff --git a/shopware/platform/6.6/public/.htaccess.dist b/shopware/platform/6.6/public/.htaccess.dist
index 62601e58..bf323130 100644
--- a/shopware/platform/6.6/public/.htaccess.dist
+++ b/shopware/platform/6.6/public/.htaccess.dist
@@ -20,6 +20,10 @@ DirectoryIndex index.php
     RewriteCond %{ENV:REDIRECT_STATUS} ^$
     RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 
+    # Restrict stored HTML without affecting responses rendered by the application.
+    RewriteCond %{REQUEST_FILENAME} -f
+    RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
+
     # If the requested filename exists, simply serve it.
     # We only want to let Apache serve files and not directories.
     RewriteCond %{REQUEST_FILENAME} -f
@@ -36,8 +40,10 @@ DirectoryIndex index.php
 </IfModule>
 
 <IfModule mod_headers.c>
+    Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
+
     <FilesMatch "\.(?i:svg)$">
-        Header set Content-Security-Policy "script-src 'none'"
+        Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
     </FilesMatch>
 </IfModule>
 
diff --git a/shopware/platform/6.7/public/.htaccess.dist b/shopware/platform/6.7/public/.htaccess.dist
index 4984a302..3e64081a 100644
--- a/shopware/platform/6.7/public/.htaccess.dist
+++ b/shopware/platform/6.7/public/.htaccess.dist
@@ -20,6 +20,10 @@ DirectoryIndex index.php
     RewriteCond %{ENV:REDIRECT_STATUS} ^$
     RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 
+    # Restrict stored HTML without affecting responses rendered by the application.
+    RewriteCond %{REQUEST_FILENAME} -f
+    RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
+
     # If the requested filename exists, simply serve it.
     # We only want to let Apache serve files and not directories.
     RewriteCond %{REQUEST_FILENAME} -f
@@ -37,8 +41,10 @@ DirectoryIndex index.php
 </IfModule>
 
 <IfModule mod_headers.c>
+    Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
+
     <FilesMatch "\.(?i:svg)$">
-        Header set Content-Security-Policy "script-src 'none'"
+        Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
     </FilesMatch>
 </IfModule>