diff --git a/web/schedule/backup/index.php b/web/schedule/backup/index.php
index 6a36030b..06881993 100644
--- a/web/schedule/backup/index.php
+++ b/web/schedule/backup/index.php
@@ -1,5 +1,16 @@
 <?php
 
+// Preventing CSRF
+if ($_SERVER['REQUEST_METHOD']=='POST') {
+    $host_arr=explode(":", $_SERVER['HTTP_HOST']);
+    $hostname=$host_arr[0];
+    $port = $_SERVER['SERVER_PORT'];
+    $expected_http_origin="https://".$hostname.":".$port;
+    if ($_SERVER['HTTP_ORIGIN'] != $expected_http_origin) {
+        die ("Nope.");
+    }
+}
+
 // Init
 error_reporting(NULL);
 ob_start();