Authorize, justify, integrity-check
Each script on the payment page is listed with who approved it, why it's needed and how its integrity is assured (version pinning, Subresource Integrity or a policy restricting where it loads from).
In development · early access
PCI 6.4.3 and 11.6.1, without a script-monitoring project.
CardSecurity is building payment page monitoring for MSPs: an inventory of every script on each merchant's checkout, with a reason and integrity method for each, and alerts when a script or security header changes.
How it maps
Built around the two requirements.
Detect unauthorized changes
The page's scripts and security headers are checked on a schedule. A new script, a changed one or a weakened header raises an alert with an owner, so someone evaluates it.
We do it ourselves first
CardSecurity' own payment pages already work this way.
Every script our payer page can load is inventoried with a written reason and pinning method, and tests fail the build if an unlisted or changed script appears.
- Script inventory with justification
- Version pinning and Subresource Integrity where providers allow it
- Strict content security policy with violation reports
- Build fails on an unlisted script
FAQ
Frequently asked questions
What do PCI DSS 6.4.3 and 11.6.1 require?
6.4.3 requires every script on a payment page to be authorized, justified and integrity-checked. 11.6.1 requires a mechanism that detects unauthorized changes to those scripts and to the page's security headers and alerts on them. Both became mandatory on March 31, 2025.
Do SAQ A merchants still need this?
SAQ A no longer lists 6.4.3 and 11.6.1. A merchant that embeds its provider's payment form (an iframe or hosted fields) must instead confirm its site is not susceptible to attacks from scripts. PCI SSC FAQ 1588 says techniques like those in 6.4.3 and 11.6.1, or written confirmation from the payment provider, can support that.
Is monitoring evidence a PCI assessment?
No. Monitoring produces supporting evidence for 6.4.3 and 11.6.1. The merchant's assessor or acquirer decides whether it meets the requirement.
When is it available?
Payment page monitoring is in development with MSP pilot partners. Request early access to be told when it's ready for your merchants.
Protect checkout from card testers today.
Join the CardSecurity pilot for managed service providers. 30-day trial, up to 5 merchants.