diff --git a/CHANGELOG b/CHANGELOG
index 3006ff4049d..78602c15e2c 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -3,6 +3,7 @@ v 7.4.0
   - Fix creating new files with web editor
   - Improve error reporting on users API (Julien Bianchi)
   - Refactor test coverage tools usage. Use SIMPLECOV=true to generate it locally
+  - Default branch is protected by default
   - Increase unicorn timeout to 60 seconds
   - Sort search autocomplete projects by stars count so most popular go first
 
diff --git a/app/services/git_push_service.rb b/app/services/git_push_service.rb
index fddfddb92ee..17c84c78d2d 100644
--- a/app/services/git_push_service.rb
+++ b/app/services/git_push_service.rb
@@ -29,6 +29,8 @@ class GitPushService
         if is_default_branch?(ref)
           # Initial push to the default branch. Take the full history of that branch as "newly pushed".
           @push_commits = project.repository.commits(newrev)
+          # Default branch is protected by default
+          project.protected_branches.create({ name: project.default_branch })
         else
           # Use the pushed commits that aren't reachable by the default branch
           # as a heuristic. This may include more commits than are actually pushed, but