diff --git a/public/.htaccess b/public/.htaccess
index b46d663..1a799b9 100644
--- a/public/.htaccess
+++ b/public/.htaccess
@@ -1,9 +1,11 @@
 # Pagina estatica do MapDisk - MT. Sem listagem de pasta e com cabecalhos de seguranca.
+# script-src 'self': a pagina nao tem script proprio, mas o Cloudflare esconde o e-mail da
+# privacidade dos robos de spam e mostra com um script servido pelo proprio dominio (/cdn-cgi).
 Options -Indexes
 DirectoryIndex index.html
 
 <IfModule mod_headers.c>
     Header set X-Content-Type-Options "nosniff"
     Header set Referrer-Policy "strict-origin-when-cross-origin"
-    Header set Content-Security-Policy "default-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'"
+    Header set Content-Security-Policy "default-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'"
 </IfModule>
diff --git a/testes/mapdisk.testes/pagina-testes.cs b/testes/mapdisk.testes/pagina-testes.cs
index f3cffea..d9b621d 100644
--- a/testes/mapdisk.testes/pagina-testes.cs
+++ b/testes/mapdisk.testes/pagina-testes.cs
@@ -46,7 +46,8 @@ public void Publicacao_confere_a_pagina_e_nao_expoe_a_conta()
         var raiz = CaracteresProibidosTestes.RaizDoRepositorio();
         var htaccess = File.ReadAllText(Publico(".htaccess"));
         Assert.Contains("Options -Indexes", htaccess);
-        Assert.Contains("script-src 'none'", htaccess);
+        Assert.Contains("script-src 'self'", htaccess);
+        Assert.DoesNotContain("unsafe-eval", htaccess);
         var deploy = File.ReadAllText(Path.Combine(raiz, ".cpanel.yml"));
         Assert.Contains("test -f $REPO/public/index.html", deploy);
         Assert.Contains("$HOME/repositories/mapdisk", deploy);