diff --git a/app.py b/app.py
index 79078cf..88d6b1f 100755
--- a/app.py
+++ b/app.py
@@ -25,6 +25,8 @@ from functools import wraps
 from datetime import datetime
 from pathlib import Path
 
+from werkzeug.middleware.proxy_fix import ProxyFix
+
 from flask import (
     Flask, jsonify, render_template,
     send_from_directory, redirect,
@@ -53,6 +55,7 @@ UPLOAD_EXTENSIONS = {".jpg", ".jpeg", ".png", ".mp4"}
 
 app = Flask(__name__)
 app.secret_key = "CHANGE_THIS_SECRET!!!"
+app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1)
 
 @app.context_processor
 def inject_globals():
@@ -769,6 +772,7 @@ def add_customer():
 
 
 @app.route("/api/customer", methods=["POST"])
+@login_required
 def api_add_customer():
     """
     API-Endpunkt für die Willkommensseite (JSON).
@@ -792,6 +796,9 @@ def api_add_customer():
         if not site:
             return jsonify({"error": "No site configured"}), 400
 
+        if not current_user.can_access_site(site):
+            return jsonify({"error": "Access denied"}), 403
+
         logo_url = generate_welcome_page.search_customer_logo(customer_name)
 
         if not logo_url: