diff --git a/app.js b/app.js
index 823ba4c..04b7e31 100644
--- a/app.js
+++ b/app.js
@@ -56,7 +56,8 @@ app.use(
         defaultSrc: ["'self'"],
         scriptSrc: ["'self'", "'unsafe-inline'"],
         scriptSrcAttr: ["'none'"],
-        styleSrc: ["'self'", "'unsafe-inline'"],
+        styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
+        fontSrc: ["'self'", "https://fonts.gstatic.com"],
         imgSrc: ["'self'", "data:"],
         connectSrc: ["'self'", "ws:", "wss:"],
       },
diff --git a/public/js/buildings/arena.js b/public/js/buildings/arena.js
index eb65db4..79d2db8 100644
--- a/public/js/buildings/arena.js
+++ b/public/js/buildings/arena.js
@@ -362,11 +362,6 @@ function openArenaPopup(src, opponentName, matchId) {
   popup.innerHTML = `
     <div id="arena-popup-titlebar">
       <div class="ap-left">
-        <div class="ap-dots">
-          <div class="ap-dot close"  id="arena-close-btn"></div>
-          <div class="ap-dot min"></div>
-          <div class="ap-dot expand" id="arena-fullscreen-btn"></div>
-        </div>
         <span class="ap-title">${title}</span>
       </div>
       <span class="ap-url">${matchId || src}</span>
@@ -377,21 +372,7 @@ function openArenaPopup(src, opponentName, matchId) {
   document.body.appendChild(backdrop);
   document.body.appendChild(popup);
 
-  /* Schließen */
-  const close = () => {
-    backdrop.remove();
-    popup.remove();
-  };
-  document.getElementById("arena-close-btn").addEventListener("click", close);
-  backdrop.addEventListener("click", (e) => {
-    // Nur schließen wenn wirklich auf den Backdrop geklickt (nicht auf Popup)
-    if (e.target === backdrop) close();
-  });
-
-  /* Vollbild */
-  document.getElementById("arena-fullscreen-btn").addEventListener("click", () => {
-    popup.requestFullscreen?.();
-  });
+  // Backdrop-Klick deaktiviert – Fenster nur über Aufgeben/Spielende schließbar
 }
 
 /* ── UI Hilfsfunktionen ────────────────────────────────────────────────────── */