diff --git a/client/src/components/circle/LearningContent.vue b/client/src/components/circle/LearningContent.vue
index 8871e809..3df552b7 100644
--- a/client/src/components/circle/LearningContent.vue
+++ b/client/src/components/circle/LearningContent.vue
@@ -47,8 +47,16 @@ const block = computed(() => {
       </button>
     </nav>
 
+    <div v-if="block.type === 'exercise'" class="h-screen">
+      <iframe
+        width="100%"
+        height="100%"
+        scrolling="no"
+        src="/media/web_based_trainings/rise_cmi5_test_export/scormcontent/index.html"
+      />
+    </div>
 
-    <div class="mx-auto max-w-5xl px-4 lg:px-8 py-4">
+    <div v-else class="mx-auto max-w-5xl px-4 lg:px-8 py-4">
       <p>{{ block.value.description }}</p>
 
       <div v-if="block.type === 'video'">
diff --git a/server/config/settings/base.py b/server/config/settings/base.py
index 43ce67e7..176f7ba0 100644
--- a/server/config/settings/base.py
+++ b/server/config/settings/base.py
@@ -170,7 +170,7 @@ MIDDLEWARE = [
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.common.BrokenLinkEmailsMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
-    "django_htmx.middleware.HtmxMiddleware",
+    "csp.middleware.CSPMiddleware",
     "vbv_lernwelt.core.middleware.auth.AuthenticationRequiredMiddleware",
     "vbv_lernwelt.core.middleware.security.SecurityRequestResponseLoggingMiddleware",
     "wagtail.contrib.redirects.middleware.RedirectMiddleware",
@@ -450,6 +450,10 @@ REST_FRAMEWORK = {
 # django-cors-headers - https://github.com/adamchainz/django-cors-headers#setup
 CORS_URLS_REGEX = r"^/api/.*$"
 
+# django-csp
+CSP_DEFAULT_SRC = ("'self'", "'unsafe-inline'", 'ws://localhost:3000', 'localhost:8000', 'blob:', 'data:', 'http://*')
+CSP_FRAME_ANCESTORS = ("'self'",)
+
 # By Default swagger ui is available only to admin user. You can change permission classs to change that
 # See more configuration options at https://drf-spectacular.readthedocs.io/en/latest/settings.html#settings
 SPECTACULAR_SETTINGS = {
diff --git a/server/requirements/requirements-dev.txt b/server/requirements/requirements-dev.txt
index 72d75c6f..4f5f0a8f 100644
--- a/server/requirements/requirements-dev.txt
+++ b/server/requirements/requirements-dev.txt
@@ -82,6 +82,7 @@ django==3.2.13
     # via
     #   -r requirements.in
     #   django-cors-headers
+    #   django-csp
     #   django-debug-toolbar
     #   django-extensions
     #   django-filter
@@ -104,6 +105,8 @@ django-cors-headers==3.11.0
     # via -r requirements.in
 django-coverage-plugin==2.0.2
     # via -r requirements-dev.in
+django-csp==3.7
+    # via -r requirements.in
 django-debug-toolbar==3.2.4
     # via -r requirements-dev.in
 django-extensions==3.1.5
diff --git a/server/requirements/requirements.in b/server/requirements/requirements.in
index fabe42b4..700df65a 100644
--- a/server/requirements/requirements.in
+++ b/server/requirements/requirements.in
@@ -24,6 +24,7 @@ dj-database-url
 django-click
 django-ratelimit
 django-ipware
+django-csp
 
 psycopg2-binary
 gunicorn
diff --git a/server/requirements/requirements.txt b/server/requirements/requirements.txt
index b3864d28..4f09972f 100644
--- a/server/requirements/requirements.txt
+++ b/server/requirements/requirements.txt
@@ -50,6 +50,7 @@ django==3.2.13
     # via
     #   -r requirements.in
     #   django-cors-headers
+    #   django-csp
     #   django-filter
     #   django-htmx
     #   django-model-utils
@@ -66,6 +67,8 @@ django-click==2.3.0
     # via -r requirements.in
 django-cors-headers==3.11.0
     # via -r requirements.in
+django-csp==3.7
+    # via -r requirements.in
 django-filter==21.1
     # via wagtail
 django-htmx==1.9.0
diff --git a/server/vbv_lernwelt/learnpath/tests/learning_path_factories.py b/server/vbv_lernwelt/learnpath/tests/learning_path_factories.py
index 260153e3..16848614 100644
--- a/server/vbv_lernwelt/learnpath/tests/learning_path_factories.py
+++ b/server/vbv_lernwelt/learnpath/tests/learning_path_factories.py
@@ -57,7 +57,7 @@ class LearningContentFactory(wagtail_factories.PageFactory):
 
 
 class VideoBlockFactory(wagtail_factories.StructBlockFactory):
-    url = "https://www.youtube.com/watch?v=dQw4w9WgXcQ"
+    url = "https://www.youtube.com/embed/qhPIfxS2hvI"
     description = "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam"
 
     class Meta:
@@ -65,7 +65,7 @@ class VideoBlockFactory(wagtail_factories.StructBlockFactory):
 
 
 class WebBasedTrainingBlockFactory(wagtail_factories.StructBlockFactory):
-    url = "https://www.example.com"
+    url = "/media/web_based_trainings/rise_cmi5_test_export/scormcontent/index.html"
     description = "Beispiel Rise Modul"
 
     class Meta:
@@ -74,7 +74,7 @@ class WebBasedTrainingBlockFactory(wagtail_factories.StructBlockFactory):
 
 class PodcastBlockFactory(wagtail_factories.StructBlockFactory):
     description = "Beispiel Podcast"
-    url = "https://docs.wagtail.org/en/stable/topics/streamfield.html"
+    url = "https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/325190984&color=%23ff5500&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false&show_teaser=true&visual=true"
 
     class Meta:
         model = PodcastBlock