diff --git a/component_catalog/templates/component_catalog/includes/scan_package_modal.html b/component_catalog/templates/component_catalog/includes/scan_package_modal.html
index c1b8ad6b..ffd9a6e4 100644
--- a/component_catalog/templates/component_catalog/includes/scan_package_modal.html
+++ b/component_catalog/templates/component_catalog/includes/scan_package_modal.html
@@ -44,9 +44,12 @@ <h5 class="modal-title">Scan Package</h5>
             Submit Scan Request
           </button>
         {% else %}
-          <a id="submit-scan-request" class="btn btn-success" href="{% url 'component_catalog:package_scan' user.dataspace object.uuid %}">
-            Submit Scan Request
-          </a>
+          <form method="post" action="{% url 'component_catalog:package_scan' user.dataspace object.uuid %}">
+            {% csrf_token %}
+            <button id="submit-scan-request" type="submit" class="btn btn-success">
+              Submit Scan Request
+            </button>
+          </form>
         {% endif %}
       </div>
     </div>
diff --git a/component_catalog/templates/component_catalog/modals/scan_delete_modal.html b/component_catalog/templates/component_catalog/modals/scan_delete_modal.html
index cb034ef3..16701e41 100644
--- a/component_catalog/templates/component_catalog/modals/scan_delete_modal.html
+++ b/component_catalog/templates/component_catalog/modals/scan_delete_modal.html
@@ -15,7 +15,10 @@ <h5 class="modal-title">Delete {% trans 'Scan' %}</h5>
       </div>
       <div class="modal-footer">
         <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-        <a class="btn btn-danger delete-confirm" href="/">Delete Scan</a>
+        <form method="post" class="delete-confirm">
+          {% csrf_token %}
+          <button type="submit" class="btn btn-danger">Delete Scan</button>
+        </form>
       </div>
     </div>
   </div>
diff --git a/component_catalog/templates/component_catalog/modals/scan_refresh_modal.html b/component_catalog/templates/component_catalog/modals/scan_refresh_modal.html
index a60f3ad3..1b1ea361 100644
--- a/component_catalog/templates/component_catalog/modals/scan_refresh_modal.html
+++ b/component_catalog/templates/component_catalog/modals/scan_refresh_modal.html
@@ -15,7 +15,10 @@ <h5 class="modal-title">Refresh {% trans 'Scan' %}</h5>
       </div>
       <div class="modal-footer">
         <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-        <a class="btn btn-success refresh-confirm" href="/">Refresh Scan</a>
+        <form method="post" class="refresh-confirm">
+          {% csrf_token %}
+          <button type="submit" class="btn btn-success">Refresh Scan</button>
+        </form>
       </div>
     </div>
   </div>
diff --git a/component_catalog/templates/component_catalog/scan_list.html b/component_catalog/templates/component_catalog/scan_list.html
index 98be39da..75c093e5 100644
--- a/component_catalog/templates/component_catalog/scan_list.html
+++ b/component_catalog/templates/component_catalog/scan_list.html
@@ -39,14 +39,18 @@
     document.addEventListener('DOMContentLoaded', function () {
       document.querySelectorAll('.scan_delete_link').forEach(link => {
         link.addEventListener('click', function() {
-          let deleteUrl = this.getAttribute('data-delete-url');
-          document.querySelector('#scan-delete-modal a.delete-confirm').pathname = deleteUrl;
+          let deleteUrl = new URL(this.getAttribute('data-delete-url'), window.location.origin);
+          if (deleteUrl.origin === window.location.origin) {
+            document.querySelector('#scan-delete-modal form.delete-confirm').action = deleteUrl.pathname;
+          }
         });
       });
       document.querySelectorAll('.scan_refresh_link').forEach(link => {
         link.addEventListener('click', function() {
-          let refreshUrl = this.getAttribute('data-refresh-url');
-          document.querySelector('#scan-refresh-modal a.refresh-confirm').pathname = refreshUrl;
+          let refreshUrl = new URL(this.getAttribute('data-refresh-url'), window.location.origin);
+          if (refreshUrl.origin === window.location.origin) {
+            document.querySelector('#scan-refresh-modal form.refresh-confirm').action = refreshUrl.pathname;
+          }
         });
       });
     });
diff --git a/component_catalog/templates/component_catalog/tabs/tab_scan.html b/component_catalog/templates/component_catalog/tabs/tab_scan.html
index b1e07a13..7e44c083 100644
--- a/component_catalog/templates/component_catalog/tabs/tab_scan.html
+++ b/component_catalog/templates/component_catalog/tabs/tab_scan.html
@@ -13,7 +13,7 @@
   </div>
   {% include 'component_catalog/includes/scan_package_modal.html' %}
   <script>
-    document.querySelector('a#submit-scan-request').addEventListener('click', function() {
+    document.querySelector('#submit-scan-request').addEventListener('click', function() {
       NEXB.displayOverlay("Submitting Scan Request...");
     });
   </script>
@@ -33,14 +33,18 @@
   <script>
     document.querySelectorAll('.scan_delete_link').forEach(link => {
       link.addEventListener('click', function() {
-        let deleteUrl = this.getAttribute('data-delete-url');
-        document.querySelector('#scan-delete-modal a.delete-confirm').pathname = deleteUrl;
+        let deleteUrl = new URL(this.getAttribute('data-delete-url'), window.location.origin);
+        if (deleteUrl.origin === window.location.origin) {
+          document.querySelector('#scan-delete-modal form.delete-confirm').action = deleteUrl.pathname;
+        }
       });
     });
     document.querySelectorAll('.scan_refresh_link').forEach(link => {
       link.addEventListener('click', function() {
-        let refreshUrl = this.getAttribute('data-refresh-url');
-        document.querySelector('#scan-refresh-modal a.refresh-confirm').pathname = refreshUrl;
+        let refreshUrl = new URL(this.getAttribute('data-refresh-url'), window.location.origin);
+        if (refreshUrl.origin === window.location.origin) {
+          document.querySelector('#scan-refresh-modal form.refresh-confirm').action = refreshUrl.pathname;
+        }
       });
     });
   </script>
diff --git a/component_catalog/tests/test_views.py b/component_catalog/tests/test_views.py
index c3feac17..2d7de4f0 100644
--- a/component_catalog/tests/test_views.py
+++ b/component_catalog/tests/test_views.py
@@ -2074,6 +2074,14 @@ def test_package_details_view_scan_package_button(self):
         response = self.client.get(self.package1_tab_scan_url)
         self.assertContains(response, expected1)
         self.assertContains(response, expected2)
+        scan_url = reverse(
+            "component_catalog:package_scan", args=[self.dataspace.name, self.package1.uuid]
+        )
+        expected_form = (
+            rf'<form method="post" action="{scan_url}">'
+            r'\s*<input type="hidden" name="csrfmiddlewaretoken" value="\w+">'
+        )
+        self.assertRegex(response.content.decode(), expected_form)
 
         alternate = Dataspace.objects.create(name="Alternate")
         alternate_user = create_superuser("alternate_user", alternate)
@@ -2990,30 +2998,111 @@ def test_delete_scan_view(self, mock_fetch_scan_list, mock_delete_scan):
         project_uuid = "348df847-f48f-4ac7-b864-5785b44c65e2"
         delete_url = reverse("component_catalog:scan_delete", args=[project_uuid])
 
-        response = self.client.get(delete_url)
+        response = self.client.post(delete_url)
         self.assertRedirects(response, f"/login/?next={delete_url}")
 
         self.client.login(username=self.super_user.username, password="secret")
         response = self.client.get(delete_url)
+        self.assertEqual(405, response.status_code)
+        mock_delete_scan.assert_not_called()
+
+        response = self.client.post(delete_url)
         self.assertEqual(404, response.status_code)
 
         self.dataspace.enable_package_scanning = True
         self.dataspace.save()
         mock_fetch_scan_list.return_value = None
-        response = self.client.get(delete_url)
+        response = self.client.post(delete_url)
         self.assertEqual(404, response.status_code)
 
         mock_fetch_scan_list.return_value = {"count": 1}
         mock_delete_scan.return_value = True
-        response = self.client.get(delete_url, follow=True)
+        response = self.client.post(delete_url, follow=True)
         scan_list_url = reverse("component_catalog:scan_list")
         self.assertRedirects(response, scan_list_url)
         self.assertContains(response, "Scan deleted.")
 
         mock_delete_scan.return_value = False
-        response = self.client.get(delete_url)
+        response = self.client.post(delete_url)
+        self.assertEqual(404, response.status_code)
+
+    @mock.patch("dejacode_toolkit.scancodeio.ScanCodeIO.refresh_scan")
+    def test_refresh_scan_view(self, mock_refresh_scan):
+        project_uuid = "348df847-f48f-4ac7-b864-5785b44c65e2"
+        refresh_url = reverse("component_catalog:scan_refresh", args=[project_uuid])
+
+        response = self.client.post(refresh_url)
+        self.assertRedirects(response, f"/login/?next={refresh_url}")
+
+        self.client.login(username=self.super_user.username, password="secret")
+        response = self.client.get(refresh_url)
+        self.assertEqual(405, response.status_code)
+        mock_refresh_scan.assert_not_called()
+
+        response = self.client.post(refresh_url)
+        self.assertEqual(404, response.status_code)
+
+        self.dataspace.enable_package_scanning = True
+        self.dataspace.save()
+        mock_refresh_scan.return_value = mock.Mock(status_code=200)
+        response = self.client.post(refresh_url, follow=True)
+        self.assertRedirects(response, reverse("component_catalog:scan_list"))
+        self.assertContains(response, "Refresh Scan started.")
+        mock_refresh_scan.assert_called_once_with(project_uuid)
+
+        mock_refresh_scan.return_value = mock.Mock(status_code=400)
+        response = self.client.post(refresh_url)
+        self.assertEqual(404, response.status_code)
+
+    @mock.patch("component_catalog.views.tasks.scancodeio_submit_scan")
+    @mock.patch("component_catalog.views.is_available")
+    @mock.patch("dejacode_toolkit.scancodeio.ScanCodeIO.is_configured")
+    def test_package_scan_view(self, mock_is_configured, mock_is_available, mock_submit_scan):
+        mock_is_configured.return_value = True
+        mock_is_available.return_value = True
+        self.dataspace.enable_package_scanning = True
+        self.dataspace.save()
+        self.package1.download_url = "https://download.url/package.zip"
+        self.package1.save()
+        scan_url = reverse(
+            "component_catalog:package_scan", args=[self.dataspace.name, self.package1.uuid]
+        )
+
+        response = self.client.post(scan_url)
+        self.assertRedirects(response, f"/login/?next={scan_url}")
+
+        self.client.login(username=self.super_user.username, password="secret")
+        response = self.client.get(scan_url)
+        self.assertEqual(405, response.status_code)
+        mock_submit_scan.assert_not_called()
+
+        response = self.client.post(scan_url, follow=True)
+        self.assertRedirects(response, f"{self.package1.details_url}#scan")
+        self.assertContains(response, "The Package URL was submitted to ScanCode.io for scanning.")
+        mock_submit_scan.assert_called_once_with(
+            uris=self.package1.download_url,
+            user_uuid=self.super_user.uuid,
+            dataspace_uuid=self.dataspace.uuid,
+        )
+
+        mock_is_configured.return_value = False
+        response = self.client.post(scan_url, headers={"HX-Request": "true"})
         self.assertEqual(404, response.status_code)
 
+    def test_scan_modals_post_with_csrf_token(self):
+        self.client.login(username=self.super_user.username, password="secret")
+        self.dataspace.enable_package_scanning = True
+        self.dataspace.save()
+
+        with mock.patch("dejacode_toolkit.scancodeio.ScanCodeIO.fetch_scan_list") as fetch:
+            fetch.return_value = None
+            response = self.client.get(reverse("component_catalog:scan_list"))
+
+        content = response.content.decode()
+        csrf_input = r'\s*<input type="hidden" name="csrfmiddlewaretoken"'
+        self.assertRegex(content, r'<form method="post" class="delete-confirm">' + csrf_input)
+        self.assertRegex(content, r'<form method="post" class="refresh-confirm">' + csrf_input)
+
     @mock.patch("dejacode_toolkit.scancodeio.ScanCodeIO.fetch_scan_data")
     @mock.patch("dejacode_toolkit.scancodeio.ScanCodeIO.is_available")
     def test_send_scan_data_as_file_view(self, mock_is_available, mock_fetch_scan_data):
diff --git a/component_catalog/views.py b/component_catalog/views.py
index 77d268d8..3f2eb9a5 100644
--- a/component_catalog/views.py
+++ b/component_catalog/views.py
@@ -1432,6 +1432,7 @@ def post(self, request, *args, **kwargs):
 
 
 @login_required
+@require_POST
 def package_scan_view(request, dataspace, uuid):
     user = request.user
     dataspace = user.dataspace
@@ -1477,7 +1478,7 @@ def package_scan_view(request, dataspace, uuid):
             messages.error(request, scancode_msg)
 
     if is_hxr:
-        return Http404
+        raise Http404
 
     return redirect(f"{package.details_url}#scan")
 
@@ -1672,6 +1673,7 @@ def send_scan_data_as_file_view(request, project_uuid, filename):
 
 
 @login_required
+@require_POST
 def delete_scan_view(request, project_uuid):
     dataspace = request.user.dataspace
     if not dataspace.enable_package_scanning:
@@ -1696,6 +1698,7 @@ def delete_scan_view(request, project_uuid):
 
 
 @login_required
+@require_POST
 def refresh_scan_view(request, project_uuid):
     user = request.user
     dataspace = user.dataspace
diff --git a/dejacode/urls.py b/dejacode/urls.py
index eb656555..e2f28527 100644
--- a/dejacode/urls.py
+++ b/dejacode/urls.py
@@ -16,7 +16,6 @@
 from django.views.generic import RedirectView
 from django.views.generic import TemplateView
 
-from notifications.views import mark_all_as_read
 from rest_framework.routers import DefaultRouter
 
 from component_catalog.api import ComponentViewSet
@@ -42,6 +41,7 @@
 from dje.views import api_docs_view
 from dje.views import home_view
 from dje.views import index_dispatch
+from dje.views import mark_all_notifications_as_read_view
 from dje.views import urn_resolve_view
 from license_library.api import LicenseAnnotationViewSet
 from license_library.api import LicenseViewSet
@@ -160,7 +160,7 @@
 notification_patterns = [
     path("", UnreadNotificationsList.as_view(), name="unread"),
     path("all/", AllNotificationsList.as_view(), name="all"),
-    path("mark_all_as_read/", mark_all_as_read, name="mark_all_as_read"),
+    path("mark_all_as_read/", mark_all_notifications_as_read_view, name="mark_all_as_read"),
     path(
         "send_scan_notification/<str:key>/", send_scan_notification, name="send_scan_notification"
     ),
diff --git a/dje/admin.py b/dje/admin.py
index 200d4944..10b884d6 100644
--- a/dje/admin.py
+++ b/dje/admin.py
@@ -53,6 +53,7 @@
 from django.utils.html import mark_safe
 from django.utils.http import urlencode
 from django.utils.translation import gettext as _
+from django.views.decorators.http import require_POST
 from django.views.generic import RedirectView
 
 from django_registration.backends.activation.views import RegistrationView
@@ -1697,7 +1698,7 @@ def get_urls(self):
             ),
             path(
                 "<path:object_id>/send_activation_email/",
-                self.admin_site.admin_view(self.send_activation_email),
+                self.admin_site.admin_view(require_POST(self.send_activation_email)),
                 name="{}_{}_send_activation_email".format(*info),
             ),
         ]
diff --git a/dje/templates/admin/dje/dataspace/change_form.html b/dje/templates/admin/dje/dataspace/change_form.html
index 6cf89e18..f4a88bd7 100644
--- a/dje/templates/admin/dje/dataspace/change_form.html
+++ b/dje/templates/admin/dje/dataspace/change_form.html
@@ -15,7 +15,8 @@
     {% endif %}
     {% if change and template_dataspace and user.is_superuser and user.dataspace.is_reference %}
         <li>
-            <a href="{% url opts|admin_urlname:'clonedataset' object_id %}" class="grp-state-focus">{% trans 'Clone dataset from' %} {{ template_dataspace }}</a>
+            <form id="clone-dataset-form" method="post" action="{% url opts|admin_urlname:'clonedataset' object_id %}" hidden>{% csrf_token %}</form>
+            <a href="javascript://" onclick="document.getElementById('clone-dataset-form').submit();" class="grp-state-focus">{% trans 'Clone dataset from' %} {{ template_dataspace }}</a>
         </li>
     {% endif %}
 {% endblock %}
\ No newline at end of file
diff --git a/dje/templates/admin/dje/dejacode_user/change_form.html b/dje/templates/admin/dje/dejacode_user/change_form.html
index 5df50830..7f9eea00 100644
--- a/dje/templates/admin/dje/dejacode_user/change_form.html
+++ b/dje/templates/admin/dje/dejacode_user/change_form.html
@@ -6,7 +6,8 @@
     {{ block.super }}
     {% if change %}
         <li>
-            <a href="{% url opts|admin_urlname:'send_activation_email' object_id %}" class="grp-state-focus">{% trans 'Re-send activation email' %}</a>
+            <form id="send-activation-email-form" method="post" action="{% url opts|admin_urlname:'send_activation_email' object_id %}" hidden>{% csrf_token %}</form>
+            <a href="javascript://" onclick="document.getElementById('send-activation-email-form').submit();" class="grp-state-focus">{% trans 'Re-send activation email' %}</a>
         </li>
     {% endif %}
 {% endblock %}
diff --git a/dje/templates/notifications/list.html b/dje/templates/notifications/list.html
index 886e8d09..2f7ac197 100644
--- a/dje/templates/notifications/list.html
+++ b/dje/templates/notifications/list.html
@@ -18,7 +18,10 @@ <h1 class="header-title">
           </h1>
         </div>
         <div class="col-auto">
-          <a class="btn btn-outline-dark btn-sm" href="{% url 'notifications:mark_all_as_read' %}">Mark all as read</a>
+          <form method="post" action="{% url 'notifications:mark_all_as_read' %}">
+            {% csrf_token %}
+            <button type="submit" class="btn btn-outline-dark btn-sm">Mark all as read</button>
+          </form>
         </div>
       </div>
     </div>
diff --git a/dje/tests/test_user.py b/dje/tests/test_user.py
index dfd51148..1d4e0011 100644
--- a/dje/tests/test_user.py
+++ b/dje/tests/test_user.py
@@ -375,7 +375,19 @@ def test_user_admin_send_activation_email_view(self):
         self.assertTrue(self.other_user.is_active)
 
         url = reverse("admin:dje_dejacodeuser_send_activation_email", args=[self.other_user.id])
-        response = self.client.get(url, follow=True)
+        response = self.client.get(url)
+        self.assertEqual(405, response.status_code)
+        self.other_user.refresh_from_db()
+        self.assertTrue(self.other_user.is_active)
+        self.assertEqual(len(mail.outbox), 0)
+
+        change_url = reverse("admin:dje_dejacodeuser_change", args=[self.other_user.id])
+        response = self.client.get(change_url)
+        self.assertContains(
+            response, f'<form id="send-activation-email-form" method="post" action="{url}" hidden>'
+        )
+
+        response = self.client.post(url, follow=True)
         expected = "An activation email will be sent shortly to the email address."
         self.assertContains(response, expected)
 
diff --git a/dje/tests/test_views.py b/dje/tests/test_views.py
index d25be9eb..b1fd5c70 100644
--- a/dje/tests/test_views.py
+++ b/dje/tests/test_views.py
@@ -20,6 +20,7 @@
 from django.urls import reverse
 
 from guardian.shortcuts import assign_perm
+from notifications.models import Notification
 
 from dje.models import Dataspace
 from dje.models import DataspaceConfiguration
@@ -335,7 +336,7 @@ def test_clone_dataset_view(self):
         change_url = reverse("admin:dje_dataspace_change", args=[self.dataspace2.pk])
 
         # TEMPLATE_DATASPACE not defined
-        response = self.client.get(clone_url)
+        response = self.client.post(clone_url)
         self.assertRedirects(response, changelist_url)
         response = self.client.get(change_url)
         self.assertNotContains(response, "Clone dataset from")
@@ -347,7 +348,14 @@ def test_clone_dataset_view(self):
         with override_settings(TEMPLATE_DATASPACE=template_dataspace):
             response = self.client.get(change_url)
             self.assertContains(response, "Clone dataset from")
-            response = self.client.get(clone_url, follow=True)
+            self.assertContains(
+                response,
+                f'<form id="clone-dataset-form" method="post" action="{clone_url}" hidden>',
+            )
+            response = self.client.get(clone_url)
+            self.assertEqual(405, response.status_code)
+            self.assertEqual(0, len(mail.outbox))
+            response = self.client.post(clone_url, follow=True)
             self.assertRedirects(response, changelist_url)
             self.assertContains(response, expected)
 
@@ -355,6 +363,26 @@ def test_clone_dataset_view(self):
         self.assertTrue("Cloning process initiated at" in mail.outbox[0].body)
         self.assertTrue("Data copy completed." in mail.outbox[0].body)
 
+    def test_mark_all_notifications_as_read_view(self):
+        Notification.objects.create(recipient=self.user, actor=self.user, verb="Test")
+        url = reverse("notifications:mark_all_as_read")
+        unread_url = reverse("notifications:unread")
+
+        response = self.client.post(url)
+        self.assertRedirects(response, f"{reverse('login')}?next={url}")
+
+        self.client.login(username=self.user.username, password="secret")
+        response = self.client.get(unread_url)
+        self.assertContains(response, f'<form method="post" action="{url}">')
+
+        response = self.client.get(url)
+        self.assertEqual(405, response.status_code)
+        self.assertEqual(1, self.user.notifications.unread().count())
+
+        response = self.client.post(url)
+        self.assertRedirects(response, unread_url)
+        self.assertEqual(0, self.user.notifications.unread().count())
+
     @override_settings(REFERENCE_DATASPACE="Dataspace")
     def test_global_search_list_view(self):
         self.client.login(username=self.user.username, password="secret")
diff --git a/dje/views.py b/dje/views.py
index 8aec73ea..7f9216c1 100644
--- a/dje/views.py
+++ b/dje/views.py
@@ -57,6 +57,7 @@
 from django.utils.html import mark_safe
 from django.utils.text import capfirst
 from django.utils.translation import gettext_lazy as _
+from django.views.decorators.http import require_POST
 from django.views.generic import CreateView
 from django.views.generic import DetailView
 from django.views.generic import FormView
@@ -1639,6 +1640,7 @@ def object_compare_view(request):
 
 
 @login_required
+@require_POST
 def clone_dataset_view(request, pk):
     """Call the clonedataset management command as a an async task."""
     changelist_url = reverse("admin:dje_dataspace_changelist")
@@ -2316,6 +2318,14 @@ class AllNotificationsList(
     pass
 
 
+@login_required
+@require_POST
+def mark_all_notifications_as_read_view(request):
+    """Replace the `notifications` library view, which marks as read on GET requests."""
+    request.user.notifications.mark_all_as_read()
+    return redirect("notifications:unread")
+
+
 class IntegrationsStatusView(
     LoginRequiredMixin,
     IsStaffMixin,
diff --git a/product_portfolio/templates/product_portfolio/modals/edit_productpackage_modal.html b/product_portfolio/templates/product_portfolio/modals/edit_productpackage_modal.html
index a8378198..b2c959dd 100644
--- a/product_portfolio/templates/product_portfolio/modals/edit_productpackage_modal.html
+++ b/product_portfolio/templates/product_portfolio/modals/edit_productpackage_modal.html
@@ -9,7 +9,11 @@ <h5 class="modal-title"><span id="title-add-update">Update</span> relationship o
       </div>
       <div class="modal-footer">
         {% if has_delete_productpackage or has_delete_productcomponent %}
-          <a id="update-productrelation-delete" class="btn btn-danger me-auto" data-bs-toggle="tooltip" data-bs-placement="top" title="Click here to delete this relationship">Delete</a>
+          <form id="update-productrelation-delete" method="post" class="me-auto">
+            {% csrf_token %}
+            <input type="hidden" name="delete" value="1">
+            <button type="submit" class="btn btn-danger" data-bs-toggle="tooltip" data-bs-placement="top" title="Click here to delete this relationship">Delete</button>
+          </form>
         {% endif %}
         <input type="button" name="close" value="Close" class="btn btn-secondary" data-bs-dismiss="modal">
         <input type="button" id="update-productrelation-submit" value="Update" class="btn btn-primary btn-success">
diff --git a/product_portfolio/templates/product_portfolio/modals/scan_delete_htmx_modal.html b/product_portfolio/templates/product_portfolio/modals/scan_delete_htmx_modal.html
index 0bf67055..1da68558 100644
--- a/product_portfolio/templates/product_portfolio/modals/scan_delete_htmx_modal.html
+++ b/product_portfolio/templates/product_portfolio/modals/scan_delete_htmx_modal.html
@@ -18,6 +18,7 @@ <h5 class="modal-title">Delete {% trans 'Scan' %}</h5>
           Cancel
         </button>
         <button hx-swap="outerHTML"
+                hx-headers='{"X-CSRFToken": "{{ csrf_token }}"}'
                 hx-on--before-request="
                   let target = document.querySelector(this.getAttribute('hx-target'));
                   if (target) target.innerHTML = 'Deleting...';
diff --git a/product_portfolio/templates/product_portfolio/product_details.html b/product_portfolio/templates/product_portfolio/product_details.html
index 918f4a72..59157fbc 100644
--- a/product_portfolio/templates/product_portfolio/product_details.html
+++ b/product_portfolio/templates/product_portfolio/product_details.html
@@ -98,9 +98,12 @@
           {% endif %}
           {% if request.user.dataspace.enable_purldb_access %}
             <div class="dropdown-header">PurlDB</div>
-            <a class="dropdown-item" id="improve_from_purldb" href="{{ object.get_improve_packages_from_purldb_url }}">
-              <i class="fas fa-database"></i> <strong>Improve</strong> Packages from PurlDB
-            </a>
+            <form method="post" action="{{ object.get_improve_packages_from_purldb_url }}">
+              {% csrf_token %}
+              <button type="submit" class="dropdown-item" id="improve_from_purldb">
+                <i class="fas fa-database"></i> <strong>Improve</strong> Packages from PurlDB
+              </button>
+            </form>
           {% endif %}
           </div>
       </div>
@@ -226,7 +229,8 @@
           // Ensure the td has an ID (assign one if missing)
           if (!td.id) td.id = "td-" + Math.random().toString(36).substr(2, 9); // Generate a random ID
 
-          confirmButton.setAttribute('hx-get', PackageScanURL);
+          confirmButton.setAttribute('hx-post', PackageScanURL);
+          confirmButton.setAttribute('hx-headers', JSON.stringify({'X-CSRFToken': csrftoken}));
           confirmButton.setAttribute("hx-target", `#${td.id}`); // Set hx-target to the ID
           htmx.process(confirmButton); // Notify HTMX about the attribute changes.
         });
@@ -267,7 +271,7 @@
           // Not in the DOM if the user has not the proper permissions
           let delete_button = $('#update-productrelation-delete');
           if (delete_button && can_delete) {
-              delete_button.attr('href', edit_url + '?delete=1');
+              delete_button.attr('action', edit_url);
               delete_button.show();
           }
           else {
diff --git a/product_portfolio/tests/test_views.py b/product_portfolio/tests/test_views.py
index a3e4ff53..73ed3aa0 100644
--- a/product_portfolio/tests/test_views.py
+++ b/product_portfolio/tests/test_views.py
@@ -16,6 +16,7 @@
 from django.core.files.base import ContentFile
 from django.core.files.uploadedfile import SimpleUploadedFile
 from django.shortcuts import resolve_url
+from django.test import Client
 from django.test import TestCase
 from django.test.utils import override_settings
 from django.urls import reverse
@@ -2494,11 +2495,15 @@ def test_product_portfolio_edit_productrelation_ajax_view_package(self):
         self.assertEqual(expected_messages, [entry.change_message for entry in history_entries])
         self.assertEqual(self.basic_user, productpackage.product.last_modified_by)
 
-        response = self.client.get(f"{edit_url}?delete=1")
+        response = self.client.post(edit_url, data={"delete": 1})
         self.assertRedirects(response, product_url + "#inventory")
 
         add_perms(self.basic_user, ["delete_productpackage"])
-        response = self.client.get(f"{edit_url}?delete=1", follow=True)
+        response = self.client.get(f"{edit_url}?delete=1")
+        self.assertEqual(200, response.status_code)
+        self.assertTrue(ProductPackage.objects.filter(pk=productpackage.pk).exists())
+
+        response = self.client.post(edit_url, data={"delete": 1}, follow=True)
         self.assertRedirects(response, product_url + "#inventory")
         msg = f"Package relationship {productpackage} successfully deleted."
         self.assertContains(response, msg)
@@ -2514,6 +2519,39 @@ def test_product_portfolio_edit_productrelation_ajax_view_package(self):
         self.assertEqual(403, response.status_code)
         self.assertEqual("application/json", response["content-type"])
 
+    @mock.patch("dejacode_toolkit.scancodeio.ScanCodeIO.is_configured")
+    @mock.patch("dejacode_toolkit.scancodeio.ScanCodeIO.delete_scan")
+    @mock.patch("dejacode_toolkit.scancodeio.ScanCodeIO.fetch_scan_list")
+    def test_product_portfolio_delete_scan_htmx_view_csrf(
+        self, mock_fetch_scan_list, mock_delete, mock_is_configured
+    ):
+        mock_is_configured.return_value = True
+        self.dataspace.enable_package_scanning = True
+        self.dataspace.save()
+        mock_fetch_scan_list.return_value = {"count": 1}
+        mock_delete.return_value = True
+        project_uuid = "348df847-f48f-4ac7-b864-5785b44c65e2"
+        delete_url = reverse(
+            "product_portfolio:scan_delete_htmx", args=[project_uuid, self.package1.uuid]
+        )
+
+        client = Client(enforce_csrf_checks=True)
+        client.login(username=self.super_user.username, password="secret")
+
+        response = client.get(delete_url)
+        self.assertEqual(405, response.status_code)
+
+        response = client.delete(delete_url)
+        self.assertEqual(403, response.status_code)
+        mock_delete.assert_not_called()
+
+        response = client.get(self.product1.get_absolute_url())
+        self.assertContains(response, 'hx-headers=\'{"X-CSRFToken": "')
+        csrf_token = client.cookies["csrftoken"].value
+        response = client.delete(delete_url, headers={"X-CSRFToken": csrf_token})
+        self.assertEqual(200, response.status_code)
+        mock_delete.assert_called_once()
+
     def test_product_portfolio_edit_productrelation_ajax_view_escape_relation_instance(self):
         package = make_package(self.dataspace, filename='"><script>alert(1)</script>')
         productpackage = ProductPackage.objects.create(
@@ -2573,11 +2611,11 @@ def test_product_portfolio_edit_productrelation_ajax_view_component(self):
         self.assertEqual(expected_messages, [entry.change_message for entry in history_entries])
         self.assertEqual(self.basic_user, productcomponent.product.last_modified_by)
 
-        response = self.client.get(f"{edit_url}?delete=1")
+        response = self.client.post(edit_url, data={"delete": 1})
         self.assertRedirects(response, product_url + "#inventory")
 
         add_perms(self.basic_user, ["delete_productcomponent"])
-        response = self.client.get(f"{edit_url}?delete=1", follow=True)
+        response = self.client.post(edit_url, data={"delete": 1}, follow=True)
         self.assertRedirects(response, product_url + "#inventory")
         msg = f"Component relationship {productcomponent} successfully deleted."
         self.assertContains(response, msg)
@@ -2636,11 +2674,11 @@ def test_product_portfolio_edit_productrelation_ajax_view_custom_component(self)
         self.assertEqual(expected_messages, [entry.change_message for entry in history_entries])
         self.assertEqual(self.basic_user, productcomponent.product.last_modified_by)
 
-        response = self.client.get(f"{edit_url}?delete=1")
+        response = self.client.post(edit_url, data={"delete": 1})
         self.assertRedirects(response, product_url + "#inventory")
 
         add_perms(self.basic_user, ["delete_productcomponent"])
-        response = self.client.get(f"{edit_url}?delete=1", follow=True)
+        response = self.client.post(edit_url, data={"delete": 1}, follow=True)
         self.assertRedirects(response, product_url + "#inventory")
         msg = f"Component relationship {productcomponent} successfully deleted."
         self.assertContains(response, msg)
@@ -3609,13 +3647,19 @@ def test_product_portfolio_improve_packages_from_purldb_view(self, mock_is_confi
         self.assertFalse(self.basic_user.has_perm("change_product", self.product1))
         self.client.login(username=self.basic_user.username, password="secret")
         url = self.product1.get_url("improve_packages_from_purldb")
-        response = self.client.get(url)
+        response = self.client.post(url)
         self.assertEqual(404, response.status_code)
 
         self.assertTrue(self.super_user.has_perm("change_product", self.product1))
         self.client.login(username=self.super_user.username, password="secret")
         url = self.product1.get_url("improve_packages_from_purldb")
-        response = self.client.get(url, follow=True)
+        response = self.client.get(self.product1.get_absolute_url())
+        self.assertContains(response, f'<form method="post" action="{url}">')
+
+        response = self.client.get(url)
+        self.assertEqual(405, response.status_code)
+
+        response = self.client.post(url, follow=True)
         self.assertEqual(200, response.status_code)
         self.assertContains(response, "Improve Packages from PurlDB in progress...")
 
@@ -3625,7 +3669,7 @@ def test_product_portfolio_improve_packages_from_purldb_view(self, mock_is_confi
             type=ScanCodeProject.ProjectType.IMPROVE_FROM_PURLDB,
             status=ScanCodeProject.Status.IMPORT_STARTED,
         )
-        response = self.client.get(url, follow=True)
+        response = self.client.post(url, follow=True)
         self.assertEqual(200, response.status_code)
         self.assertContains(response, "Improve Packages already in progress...")
 
diff --git a/product_portfolio/views.py b/product_portfolio/views.py
index 91318500..647921ad 100644
--- a/product_portfolio/views.py
+++ b/product_portfolio/views.py
@@ -1678,7 +1678,7 @@ def edit_productrelation_ajax_view(request, relation_type, relation_uuid):
         return JsonResponse({"error_message": "Permission denied"}, status=403)
 
     has_delete_permission = user.has_perm(f"product_portfolio.delete_{relationship_model_name}")
-    if request.GET.get("delete"):
+    if request.method == "POST" and request.POST.get("delete"):
         if has_delete_permission:
             History.log_deletion(user, relation_instance)
             relation_verbose_name = relation_type.replace("-", " ")
@@ -2957,6 +2957,7 @@ def scancodeio_project_download_input_view(request, scancodeproject_uuid):
 
 
 @login_required
+@require_POST
 def improve_packages_from_purldb_view(request, dataspace, name, version=""):
     user = request.user
     guarded_qs = Product.objects.get_queryset(user)
@@ -3095,7 +3096,6 @@ def apply_analysis_preset_view(request, productpackage_uuid, advisory_uid, prese
 
 
 @login_required
-@csrf_exempt
 @require_http_methods(["DELETE"])
 def delete_scan_htmx_view(request, project_uuid, package_uuid):
     dataspace = request.user.dataspace