diff --git a/backend/server.js b/backend/server.js
index a2846af..e6effde 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -212,7 +212,7 @@ app.post('/api/users/deduct-credit', authenticate, async (req, res) => {
 // 10. Upload file
 app.post('/api/upload', authenticate, upload.single('file'), (req, res) => {
   if (!req.file) return res.status(400).json({ error: 'No file uploaded' });
-  const url = `${req.protocol}://${req.get('host')}/uploads/${req.file.filename}`;
+  const url = `/uploads/${req.file.filename}`;
   res.json({ url });
 });
 
diff --git a/index.html b/index.html
index dd051ef..16a1538 100644
--- a/index.html
+++ b/index.html
@@ -3,6 +3,7 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
     <title>Titan - Product configurator.</title>
   </head>
   <body>