diff --git a/libraries/Header.class.php b/libraries/Header.class.php
index a465daa69c..a6a1a7fde8 100644
--- a/libraries/Header.class.php
+++ b/libraries/Header.class.php
@@ -439,6 +439,9 @@ class PMA_Header
      */
     public function sendHttpHeaders()
     {
+        $https = $GLOBALS['PMA_Config']->isHttps();
+        $mapTilesUrls = ' *.tile.openstreetmap.org *.tile.opencyclemap.org';
+
         /**
          * Sends http headers
          */
@@ -447,7 +450,9 @@ class PMA_Header
             header(
                 "X-Content-Security-Policy: allow 'self';"
                 . "options inline-script eval-script;"
-                . "img-src 'self' data:; "
+                . "img-src 'self' data:"
+                . ($https ? "" : $mapTilesUrls)
+                . ";"
             );
             if (PMA_USR_BROWSER_AGENT == 'SAFARI'
                 && PMA_USR_BROWSER_VER < '6.0.0'
@@ -455,13 +460,18 @@ class PMA_Header
                 header(
                     "X-WebKit-CSP: allow 'self';"
                     . "options inline-script eval-script;"
-                    . "img-src 'self' data:; "
+                    . "img-src 'self' data:"
+                    . ($https ? "" : $mapTilesUrls)
+                    . ";"
                 );
             } else {
                 header(
                     "X-WebKit-CSP: default-src 'self';"
                     . "script-src 'self' 'unsafe-inline' 'unsafe-eval';"
-                    . "style-src 'self' 'unsafe-inline'"
+                    . "style-src 'self' 'unsafe-inline';"
+                    . "img-src 'self' data:"
+                    . ($https ? "" : $mapTilesUrls)
+                    . ";"
                 );
             }
         }