---
description: The Content Security Policy directives Stripe.js requires, and how to send CSP violation reports to Report URI.
---

# Stripe

Stripe publishes the exact directives Stripe.js needs, which makes it one of the easier integrations to bring under a CSP. The catch is that the requirements grow as you turn on more features - 3D Secure and the Address Element both add entries.

Stripe.js has to be loaded directly from Stripe's domain rather than bundled or self-hosted, so these domains are not optional.

## What Stripe requires

- `script-src` - `https://js.stripe.com` and `https://*.js.stripe.com`
- `frame-src` - `https://js.stripe.com`, `https://*.js.stripe.com` and `https://hooks.stripe.com`
- `connect-src` - `https://api.stripe.com`

Allowing `*.js.stripe.com` lets Stripe.js start frames on different origins where possible, which improves performance.

Two additions depending on what you use:

- Payment methods with a redirect step, such as cards requiring 3D Secure, need `https://hooks.stripe.com` in `frame-src`.
- The Address Element with your own Google Maps API key needs `https://maps.googleapis.com` in both `connect-src` and `script-src`.

If you use Trusted Types, dynamic scripts from `https://js.stripe.com` and `https://*.js.stripe.com` must be allowed.

## Sending reports to Report URI

Add a reporting directive alongside the Stripe directives. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    Content-Security-Policy-Report-Only: script-src 'self' https://js.stripe.com https://*.js.stripe.com; frame-src https://js.stripe.com https://*.js.stripe.com https://hooks.stripe.com; connect-src 'self' https://api.stripe.com; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

## Things to watch for

- A policy tuned against a successful card payment often breaks the first time a payment triggers 3D Secure, because that path only touches `hooks.stripe.com` under challenge. Test a card that forces the challenge.
- Payment pages are in scope for PCI DSS 6.4.3 and 11.6.1. Our [Compliance](/compliance/) guides cover what an assessor will expect to see.
- Stripe's requirements change as they add features. Re-check the official page before a major integration change rather than after reports start arriving.

## Official documentation

[Stripe - Security at Stripe](https://docs.stripe.com/security/guide)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)