diff --git a/server/helpers/common.js b/server/helpers/common.js
index 21cd577da1..2b64175b60 100644
--- a/server/helpers/common.js
+++ b/server/helpers/common.js
@@ -45,6 +45,7 @@ module.exports = {
   getCookieOpts () {
     return {
       expires: DateTime.utc().plus({ days: 365 }).toJSDate(),
+      httpOnly: true,
       ...(WIKI.config.host.startsWith('https://') ? { secure: true } : {})
     }
   }
diff --git a/server/models/pages.js b/server/models/pages.js
index bb5b658512..dfb73406c6 100644
--- a/server/models/pages.js
+++ b/server/models/pages.js
@@ -292,7 +292,7 @@ module.exports = class Page extends Model {
       locale: opts.locale,
       path: opts.path
     })) {
-      scriptJs = opts.scriptJs || ''
+      scriptJs = opts.scriptJs ? opts.scriptJs.replace(/<script/gi, '') : ''
     }
 
     // -> Create page
@@ -419,7 +419,7 @@ module.exports = class Page extends Model {
       locale: opts.locale,
       path: opts.path
     })) {
-      scriptJs = opts.scriptJs || ''
+      scriptJs = opts.scriptJs ? opts.scriptJs.replace(/<script/gi, '') : ''
     }
 
     // -> Update page