---
id: content-security-policy
title: Content security policy
hide_title: true
description: "Content sources for Walley iframe"
---

import Ingress from "../../src/components/ingress/ingress.react";

<Ingress title="Content Security Policy">
  [Content Security Policy
  (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) is a
  security mechanism that helps prevent malicious content from being executed on
  a webpage by specifying trusted sources for scripts, styles, and other
  resources.
</Ingress>

## Walley iframe

The Walley iframe is a secure way to collect sensitive
payment information. To secure the iframe, only allow content from trusted sources.

We strongly recommend that CSP is used to restrict the sources of content that can be loaded.
The following domains are used by Walley and should be allowed in your CSP depending on environment.

:::info
The domain lists below are subject to change. Subscribe for updates in the Merchant Hub to stay up to date.
:::

### Production

| URL                               | Description                                |
| :-------------------------------- | :----------------------------------------- |
| https://\*.walleypay.com          | Main domain that Walley Pay uses           |
| https://\*.checkout.walleypay.com | Main domain that Walley Pay uses           |
| https://\*.paymentiq.io           | Needed for card payments                   |
| https://\*.cdn-apple.com          | Needed for Apple Pay payments              |
| https://\*.ingrid.com             | Needed if Ingrid delivery adapter is used  |

### Test

| URL                                   | Description                                |
| :------------------------------------ | :----------------------------------------- |
| https://\*.uat.walleydev.com          | Main domain that Walley Pay uses           |
| https://\*.checkout.uat.walleydev.com | Main domain that Walley Pay uses           |
| https://\*.paymentiq.io               | Needed for card payments                   |
| https://\*.cdn-apple.com              | Needed for Apple Pay payments              |
| https://\*.ingrid.com                 | Needed if Ingrid delivery adapter is used  |

:::warning Important
If you are using the deprecated 'collector.se' URL for iframe loader please update. See [Endpoints](/docs/checkout/endpoints) for more information.
:::