diff --git a/web/index.html b/web/index.html
index 00369dc..6ed44f7 100644
--- a/web/index.html
+++ b/web/index.html
@@ -1,6 +1,9 @@
 <!DOCTYPE html>
 <html lang="de" data-theme="dark">
 <head>
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self';">
+  <meta http-equiv="X-Content-Type-Options" content="nosniff">
+  <meta name="referrer" content="strict-origin-when-cross-origin">
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>BenzCloud – Web-Hosting Plugin</title>
@@ -69,8 +72,10 @@
   <footer class="app-footer">
     <span>BenzCloud Web-Plugin © 2026 Jeremy Benz • GNU GPLv3 Lizenz</span>
     <span class="pill-pre">Pre-Release / In aktiver Entwicklung</span>
+  <div class="routing-notice" style="text-align: center; padding: 1rem; font-size: 0.75rem; opacity: 0.5; font-family: monospace;">2-Tier Routing: /benzcloud-plugin-web/ (Landing) | /benzcloud-plugin-web/app/ (Web-App)</div>
   </footer>
 
   <script src="app.js"></script>
+  <section class="cta-section" style="margin: 3rem 0; text-align: center; font-family: sans-serif;"><div style="background: rgba(245, 158, 11, 0.1); border: 1px solid rgba(245, 158, 11, 0.3); border-radius: 12px; padding: 2rem; display: inline-block; max-width: 90%;"><h3 style="margin-top: 0; color: #f59e0b;">Zentrale App-Zentrale</h3><p style="margin-bottom: 1.5rem; opacity: 0.8;">Alle meine Apps und Projekte an einem Ort.</p><a class="btn-benzstore" href="https://benzjeremy.github.io/benzstore/" target="_blank" rel="noopener noreferrer" style="background: #f59e0b; color: #fff; padding: 12px 28px; border-radius: 8px; text-decoration: none; font-weight: bold; display: inline-block; box-shadow: 0 4px 12px rgba(245, 158, 11, 0.3);">🚀 BenzStore entdecken</a></div></section>
 </body>
 </html>
