---
description: The Content Security Policy directives Mollie Components requires, and how to send CSP violation reports to Report URI.
---

# Mollie

Mollie's CSP requirement is refreshingly short - three lines - and their documentation goes further than most by actively telling merchants to run a strict CSP on their checkout in the first place.

## What Mollie requires

Mollie Components loads from a single domain:

- `script-src` - `js.mollie.com`
- `frame-src` - `js.mollie.com`
- `style-src` - `'unsafe-inline'`

That is the whole list. Because Components renders the card fields in an iframe served from Mollie's own origin, the card data never touches your page - which is also why the `frame-src` entry is not optional.

## Sending reports to Report URI

Add a reporting directive to your policy. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' js.mollie.com; frame-src js.mollie.com; style-src 'self' 'unsafe-inline'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

## Things to watch for

- `style-src 'unsafe-inline'` is required for Components to style its fields. It is a genuine weakening of the policy, so keep it on `style-src` only - an `'unsafe-inline'` that ends up applying to scripts undoes most of what the policy is for.
- A short vendor list is not a short policy. Mollie is three lines; the rest of your checkout - analytics, chat widgets, tag managers - is where the reports will actually come from.
- Mollie's own guidance is to run a strict CSP on checkout. Report-only first is how you get there without breaking a payment page.

## Official documentation

[Mollie - Mollie Components](https://docs.mollie.com/docs/mollie-components)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page. Working towards PCI DSS 4.0? Start with our [Compliance](/compliance/) guides.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)