diff --git a/_define.php b/_define.php
index ff78b71..e4ed79d 100644
--- a/_define.php
+++ b/_define.php
@@ -27,5 +27,5 @@
 );
 
 $this->setCsrfExclusions([
-    '/paypal_(success|notify|cancelled)/',
+    '/paypal_success/',
 ]);
diff --git a/templates/default/paypal_preferences.html.twig b/templates/default/paypal_preferences.html.twig
index 4f2629e..a693ea8 100644
--- a/templates/default/paypal_preferences.html.twig
+++ b/templates/default/paypal_preferences.html.twig
@@ -74,7 +74,6 @@
                 <i class="save icon"></i> {{ _T("Save") }}
             </button>
             <input type="hidden" name="valid" value="1"/>
-            {% include "components/forms/csrf.html.twig" %}
         </div>
     </form>
 {% endblock %}