diff --git a/src/messenger/webim/operator/features.php b/src/messenger/webim/operator/features.php
index ad193830..9c7fc9ac 100644
--- a/src/messenger/webim/operator/features.php
+++ b/src/messenger/webim/operator/features.php
@@ -23,6 +23,8 @@ require_once('../libs/common.php');
 require_once('../libs/operator.php');
 require_once('../libs/settings.php');
 
+csrfchecktoken();
+
 $operator = check_login();
 
 $page = array('agentId' => '');
diff --git a/src/messenger/webim/operator/performance.php b/src/messenger/webim/operator/performance.php
index ad8908d2..f2f48e8f 100644
--- a/src/messenger/webim/operator/performance.php
+++ b/src/messenger/webim/operator/performance.php
@@ -23,6 +23,8 @@ require_once('../libs/common.php');
 require_once('../libs/operator.php');
 require_once('../libs/settings.php');
 
+csrfchecktoken();
+
 $operator = check_login();
 
 $page = array('agentId' => '');
@@ -91,4 +93,4 @@ prepare_menu($operator);
 setup_settings_tabs(2);
 start_html_output();
 require('../view/performance.php');
-?>
\ No newline at end of file
+?>
diff --git a/src/messenger/webim/view/features.php b/src/messenger/webim/view/features.php
index 9b8361a4..48f1a1cd 100644
--- a/src/messenger/webim/view/features.php
+++ b/src/messenger/webim/view/features.php
@@ -73,6 +73,10 @@ require_once('inc_errors.php');
 <?php } ?>
 
 <form name="features" method="post" action="<?php echo $webimroot ?>/operator/features.php">
+
+<!-- add auth token -->
+<?php print_csrf_token_input() ?>
+
 <input type="hidden" name="sent" value="true"/>
 	<div>
 <?php print_tabbar(); ?>
@@ -211,4 +215,4 @@ require_once('inc_errors.php');
 } /* content */
 
 require_once('inc_main.php');
-?>
\ No newline at end of file
+?>
diff --git a/src/messenger/webim/view/performance.php b/src/messenger/webim/view/performance.php
index fa9513bc..5690c90c 100644
--- a/src/messenger/webim/view/performance.php
+++ b/src/messenger/webim/view/performance.php
@@ -40,6 +40,9 @@ require_once('inc_errors.php');
 
 <form name="performance" method="post" action="<?php echo $webimroot ?>/operator/performance.php">
 
+<!-- add auth token -->
+<?php print_csrf_token_input() ?>
+
 	<div>
 <?php print_tabbar(); ?>
 	<div class="mform"><div class="formtop"><div class="formtopi"></div></div><div class="forminner">
@@ -118,4 +121,4 @@ require_once('inc_errors.php');
 } /* content */
 
 require_once('inc_main.php');
-?>
\ No newline at end of file
+?>