{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-docs/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["tabs","tab"]},"type":"markdown"},"seo":{"title":"CSP integration","meta":[{"name":"robots","content":"noindex, nofollow"},{"name":"pingdom","content":"sh3MDv8mJpWhCWSTdGtN"}]},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"csp-integration","__idx":0},"children":["CSP integration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["CSP is a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["security standard"]}," that helps protect websites from attacks like:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Cross-Site Scripting (XSS)"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data injection"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Clickjacking"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Other types of malicious content inclusion"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["It works by allowing site owners to define ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["which sources of content"]}," (scripts, images, styles, etc.) the browser is allowed to load."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Please see the guidance for our merchants below:"]},{"$$mdtype":"Tag","name":"Tabs","attributes":{"size":"medium"},"children":[{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Checkout","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"text","header":{"controls":{"copy":{}}},"source":"script-src \nhttps://dev.shift4.com\nhttps://js.dev.shift4.com\nhttps://applepay.cdn-apple.com  //for Apple Pay integrations only\n\nframe-src\nhttps://dev.shift4.com\nhttps://js.dev.shift4.com\n\nconnect-src\nhttps://dev.shift4.com\nhttps://t.dev.shift4.com\n\nimg-src\nhttps://dev.shift4.com\nhttps://t.dev.shift4.com\n","lang":"text"},"children":[]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Components","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"text","header":{"controls":{"copy":{}}},"source":"script-src\nhttps://js.dev.shift4.com\nhttps://applepay.cdn-apple.com\n\nframe-src\nhttps://js.dev.shift4.com\n\nimg-src\nhttps://t.dev.shift4.com\ndata:\n\nconnect-src\nhttps://t.dev.shift4.com\n","lang":"text"},"children":[]}]}]}]},"headings":[{"value":"CSP integration","id":"csp-integration","depth":1}],"frontmatter":{"title":"CSP integration","description":"Content Security Policy directives to allow when integrating Shift4 Checkout or Components into your website.","seo":{"title":"CSP integration"}},"lastModified":"2026-10-21T07:31:06.908Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/csp-integration","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}