Problem
Some or all card transactions are result in a 'blocked content' message on the Payment page of the web checkout.
Content Blocked Error
Reason
This error can occur when a Content Security Policy (CSP) is implemented on your website.
What is a Content Security Policy (CSP)?
A CSP is a security mechanism where a website defines rules that specify:
what domains JavaScript files can be loaded from
whether inline JavaScript is allowed
what other resources (CSS, images, fonts, iframes) are permitted
During payment, certain card transactions require 3D Secure (3DS) authentication. The 3DS process loads iframes from domains controlled by the card issuer or bank. Because there is a large number of possible issuer domains, it is not possible to list them all in a CSP. A strict CSP may therefore block these iframes from loading and prevent the transaction from completing.
📒 NOTE
According to the PCI Security Standards Council, the 3DS script validation process is exempt from PCI DSS Requirement 6.4.3. The trust relationship with the 3DS service provider is established through due diligence, onboarding, and business agreements — not through CSP rules.
Solution
To prevent 3DS iframes from being blocked, configure your CSP to permit loading from all domains. This is the approach recommended by Adyen where 3DS is in use.
📗 TIP
Follow the steps in Adyen's documentation to configure your CSP integration.