diff --git a/app/Exceptions/Handler.php b/app/Exceptions/Handler.php
index 287a96dc..45b5c22c 100644
--- a/app/Exceptions/Handler.php
+++ b/app/Exceptions/Handler.php
@@ -5,6 +5,7 @@ namespace App\Exceptions;
 use Exception;
 use Illuminate\Http\Response;
 use App\Exceptions\PrettyPageException;
+use Illuminate\Session\TokenMismatchException;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Foundation\Validation\ValidationException;
 use Symfony\Component\HttpKernel\Exception\HttpException;
@@ -22,6 +23,7 @@ class Handler extends ExceptionHandler
     protected $dontReport = [
         HttpException::class,
         ModelNotFoundException::class,
+        TokenMismatchException::class,
         ValidationException::class,
         PrettyPageException::class,
         MethodNotAllowedHttpException::class,
@@ -52,7 +54,11 @@ class Handler extends ExceptionHandler
         }
 
         if ($e instanceof MethodNotAllowedHttpException) {
-            abort(403, 'Method not allowed.');
+            abort(403, trans('errors.http.method-not-allowed'));
+        }
+
+        if ($e instanceof TokenMismatchException) {
+            return json(trans('errors.http.csrf-token-mismatch'), 1);
         }
 
         if ($e instanceof PrettyPageException) {
diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index 8e45f39c..9b7f383f 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -31,6 +31,7 @@ class Kernel extends HttpKernel
             \Illuminate\View\Middleware\ShareErrorsFromSession::class,
             \App\Http\Middleware\AfterSessionBooted::class,
             \App\Http\Middleware\DetectLanguagePrefer::class,
+            \App\Http\Middleware\VerifyCsrfToken::class,
         ],
 
         'static' => [],
diff --git a/app/Http/Middleware/VerifyCsrfToken.php b/app/Http/Middleware/VerifyCsrfToken.php
new file mode 100644
index 00000000..bcb9ceec
--- /dev/null
+++ b/app/Http/Middleware/VerifyCsrfToken.php
@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;
+
+class VerifyCsrfToken extends BaseVerifier
+{
+    /**
+     * The URIs that should be excluded from CSRF verification.
+     *
+     * @var array
+     */
+    protected $except = [
+        'setup/*'
+    ];
+}
diff --git a/resources/assets/src/js/common/utils.js b/resources/assets/src/js/common/utils.js
index f20044d5..3a902ff0 100644
--- a/resources/assets/src/js/common/utils.js
+++ b/resources/assets/src/js/common/utils.js
@@ -9,6 +9,12 @@ console.log(
     'font-style:italic;', ''
 );
 
+$.ajaxSetup({
+    headers: {
+        'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
+    }
+});
+
 /**
  * Check if given value is empty.
  *
diff --git a/resources/lang/en/errors.yml b/resources/lang/en/errors.yml
index 3cd9724f..05f8518e 100644
--- a/resources/lang/en/errors.yml
+++ b/resources/lang/en/errors.yml
@@ -3,6 +3,8 @@ http:
   msg-404: Nothing here.
   msg-500: Please try again later.
   msg-503: The application is now in maintenance mode.
+  method-not-allowed: Method not allowed.
+  csrf-token-mismatch: Token does not match, try reloading the page.
 
 general:
   title: Error occurred
diff --git a/resources/lang/zh_CN/errors.yml b/resources/lang/zh_CN/errors.yml
index c469fa56..80189e12 100644
--- a/resources/lang/zh_CN/errors.yml
+++ b/resources/lang/zh_CN/errors.yml
@@ -3,6 +3,8 @@ http:
   msg-404: 这里啥都没有哦
   msg-500: 内部服务器错误，请稍后再试
   msg-503: 网站维护中
+  method-not-allowed: 不允许的 HTTP 请求方法
+  csrf-token-mismatch: Token 不正确，请尝试刷新页面
 
 general:
   title: 出现错误
diff --git a/resources/views/admin/master.blade.php b/resources/views/admin/master.blade.php
index e43df192..98779095 100644
--- a/resources/views/admin/master.blade.php
+++ b/resources/views/admin/master.blade.php
@@ -6,7 +6,8 @@
     <title>@yield('title') - {{ option_localized('site_name') }}</title>
     {!! bs_favicon() !!}
     <!-- Tell the browser to be responsive to screen width -->
-    <meta content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" name="viewport">
+    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
+    <meta name="csrf-token" content="{{ csrf_token() }}">
     <!-- App Styles -->
     @include('common.dependencies.style', ['module' => 'admin'])
 
diff --git a/resources/views/auth/master.blade.php b/resources/views/auth/master.blade.php
index b97c00ff..c15a617d 100644
--- a/resources/views/auth/master.blade.php
+++ b/resources/views/auth/master.blade.php
@@ -5,7 +5,8 @@
     <meta http-equiv="X-UA-Compatible" content="IE=edge">
     <title>@yield('title') - {{ option_localized('site_name') }}</title>
     {!! bs_favicon() !!}
-    <meta content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" name="viewport">
+    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
+    <meta name="csrf-token" content="{{ csrf_token() }}">
     <!-- App Styles -->
     @include('common.dependencies.style', ['module' => 'auth'])
 
diff --git a/resources/views/skinlib/master.blade.php b/resources/views/skinlib/master.blade.php
index 2e620707..702a4469 100644
--- a/resources/views/skinlib/master.blade.php
+++ b/resources/views/skinlib/master.blade.php
@@ -6,7 +6,8 @@
     <title>@yield('title') - {{ option_localized('site_name') }}</title>
     {!! bs_favicon() !!}
     <!-- Tell the browser to be responsive to screen width -->
-    <meta content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" name="viewport">
+    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
+    <meta name="csrf-token" content="{{ csrf_token() }}">
     <!-- App Styles -->
     @include('common.dependencies.style', ['module' => 'skinlib'])
 
diff --git a/resources/views/user/master.blade.php b/resources/views/user/master.blade.php
index 87246fe6..2f6de01f 100644
--- a/resources/views/user/master.blade.php
+++ b/resources/views/user/master.blade.php
@@ -6,7 +6,8 @@
     <title>@yield('title') - {{ option_localized('site_name') }}</title>
     {!! bs_favicon() !!}
     <!-- Tell the browser to be responsive to screen width -->
-    <meta content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" name="viewport">
+    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
+    <meta name="csrf-token" content="{{ csrf_token() }}">
     <!-- App Styles -->
     @include('common.dependencies.style', ['module' => 'user'])