diff --git a/tracker/tests.py b/tracker/tests.py
index b97479a..95311db 100644
--- a/tracker/tests.py
+++ b/tracker/tests.py
@@ -13,6 +13,18 @@ class TestViews(TestCase):
     def setUp(self):
         self.client.login(username='admin', password='admin')
 
+    def test_markdown(self):
+        response = self.client.get(reverse('markdown'))
+        self.assertEqual(response.status_code, 405) # get method not allowed
+        response = self.client.post(reverse('markdown'), {
+            'data': '**bold**',
+        })
+        self.assertContains(response, '<strong>bold</strong>')
+        response = self.client.post(reverse('markdown'), {
+            'data': '<script></script>',
+        })
+        self.assertNotContains(response, '<script>')
+
     def test_admin(self):
         response = self.client.get(reverse('admin'))
         self.assertRedirects(response, reverse('settings'))
diff --git a/tracker/views.py b/tracker/views.py
index 4161731..6700c3a 100644
--- a/tracker/views.py
+++ b/tracker/views.py
@@ -23,6 +23,7 @@ import shlex
 ####################
 
 @login_required
+@require_http_methods(["POST"])
 def markdown_preview(request):
     content = request.POST.get('data', '')
     return HttpResponse(markdown_to_html(content))