---
description: Adyen's script security guidance for PCI DSS 6.4.3 and 11.6.1, the CSP directives Adyen requires, and how to report to Report URI.
---

# Adyen

Adyen is unusual among payment providers in publishing its CSP guidance as part of a PCI DSS compliance guide rather than as an integration footnote. Their script security page maps directly onto Requirements 6.4.3 and 11.6.1, and recommends collecting violation reports at an endpoint - which is exactly the control those requirements are asking for.

## What Adyen recommends

- Allow internally-loaded scripts by default, then expressly allow scripts from non-internal domains.
- Trusted sources for their integrations include `*.adyen.com` plus the domains for the wallets and schemes you have enabled: `pay.google.com`, `*.payments-amazon.com`, `*.paypal.com`, `*.ratepay.com`, `*.cash.app`, and `*.mastercard.com` and `*.visa.com` for Click to Pay.
- For iframes, Adyen recommends a wildcard to accommodate 3D Secure authentication, which is exempt from Requirement 6.4.3.
- The `report-to` directive with a `Reporting-Endpoints` header for sending violation reports to a collector.

## Sending reports to Report URI

Adyen's guidance uses the Reporting API. Your endpoint URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    Reporting-Endpoints: csp-endpoint="https://abc123.report-uri.com/r/d/csp/reportOnly"

    Content-Security-Policy-Report-Only: script-src 'self' *.adyen.com; report-to csp-endpoint

See our [Reporting API](/setup/reporting-api/) guide for the full setup, and keep the older `report-uri` directive alongside `report-to` for browsers that have not moved over.

## Things to watch for

- The domain list depends on which payment methods you have enabled. Turning on a new wallet in the Customer Area can start generating violations on a policy that was clean the day before.
- The 3D Secure exemption in 6.4.3 covers the issuing bank's ACS pages, whose URLs vary by issuer and change regularly. That is why a wildcard is recommended for iframes rather than an enumerated list.
- 11.6.1 asks for detection of unauthorised change to headers and script content, not just a policy. [Policy Watch](/setup/policy-watch/) and [Script Watch](/setup/script-watch/) cover that half, and our [PCI DSS 11.6.1](/compliance/pci-dss-11-6-1/) guide explains how the pieces fit together.

## Official documentation

[Adyen - Script security for ecommerce](https://docs.adyen.com/development-resources/pci-dss-compliance-guide/script-security)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page. Working towards PCI DSS 4.0? Start with our [Compliance](/compliance/) guides.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)