Source Defense pricing
Source Defense publishes its figures, which is unusual here. This is what each plan costs, where the limits bite, and how it compares against ours.
TL;DR
Source Defense pricing
PUBLISHED FIGURES
Essentials $98/month, Standard $197, Professional $315, Enterprise custom. Billed annually at $1,176, $2,364 and $3,780.
WHAT THE TIERS LIMIT
Page views, domains, payment pages and retention all step up by tier, and client-side security is a second product.
THE THING TO CHECK
The headline figure is a dollar from ours. The limits behind it are where the two products actually differ.
Short on time? We publish ours, which is the only figure on this page we can state with certainty. See it.
How much does Source Defense cost?
Source Defense publishes four tiers. Essentials is $98 a month, billed annually at $1,176, for 100,000 page views a month, one domain and 30-day retention. Standard is $197 a month for 250,000 page views and three domains. Professional is $315 a month for 500,000 page views and ten domains. Enterprise is custom, with 18-month retention. Two things are easy to miss. Payment-page limits apply when PCI Compliance is selected: two pages on Essentials, five on Standard, ten on Professional. And client-side security is a second product added on top of the PCI one, with a bundle discount rather than a single price.
One first-party tag, added the way your stack already ships code. No DNS change and no CDN change, because your traffic is never routed anywhere.
What each plan includes
1
Essentials, $98/month
100,000 page views, one domain, two payment pages, 30-day retention. Detection and email alerts, and no human support.
2
Standard, $197/month
250,000 page views, three domains, five payment pages, 60-day retention. Adds behaviour baselining and on-demand blocking.
3
Professional, $315/month
500,000 page views, ten domains, ten payment pages, 90-day retention. Adds SSO/SAML, RBAC, audit logs and email support.
4
Enterprise, custom
Custom volume and domains, 18-month retention. REST API, SIEM integration and webhooks are Enterprise-only.
5
The second product
Client-side security is added to the PCI product rather than included, at a discount when both are taken.
What to check before you buy
A price for both products if you need PCI and client-side security, because a headline tier covers one of them
Whether your domain count fits, since Essentials covers one and Professional ten
How many payment pages you actually have, because the tiers cap them at two, five and ten
Whether 30-day retention on Essentials satisfies your assessor, given evidence is usually asked for over a longer window
Whether you need webhooks, a REST API or SIEM export, all of which are Enterprise-only
What support you get, because Essentials and Standard include no human support at all
Our pricing is published, so you can compare a quote against it directly.
Comparing against something published
Both sides are published here, which is rare in this category. Ours: free for 1,000 page views a month, $99/month for 100,000 payment-page views, $499/month at 500,000, $799/month at 1,000,000, overage at $0.0013 per page view, annual billing at 10 months instead of 12.
At the entry tier the two are a dollar apart, so the headline is not the story. Their Essentials covers one domain, two payment pages and 30 days of retention, with no human support. Ours has no cap on domains, scripts, vendors or payment pages, keeps evidence packs for 18 months, and includes email support on the free plan.
Worth saying plainly: Source Defense sandboxes third-party scripts rather than only watching them, which is a genuinely different control and the right answer if you want to constrain what a vendor script can do rather than record what it did. Full detail in the Source Defense comparison.
Sources and methodology
PCI DSS requirement text is quoted from PCI DSS v4.0.1 (June 2024), published by the PCI Security Standards Council, which is the current version at the time of writing. Requirements 6.4.3 and 11.6.1 became mandatory on 31 March 2025. Where we describe a competitor, we describe publicly available information and say so when something should be verified with the vendor. We publish this product and that is a bias worth knowing about while you read.
ASK AN AI
Don’t just take our word for it
Ask your assistant what to look for in a tool for PCI DSS 6.4.3 and 11.6.1.
Frequently asked questions
Yes, which is unusual in this category. Essentials is $98 a month, Standard $197, Professional $315, and Enterprise is custom. Annual billing is $1,176, $2,364 and $3,780.
$98 a month, billed annually at $1,176. That covers 100,000 page views a month, one domain, two payment pages and 30 days of retention.
No. There is a 14-day free trial on the self-serve tiers. Ours is a permanent free plan of 1,000 page views a month with both PCI requirements included and no credit card.
One on Essentials, three on Standard, ten on Professional, and custom on Enterprise. We do not cap domains on any plan, including the free one.
Two on Essentials, five on Standard and ten on Professional, when PCI Compliance is selected. We do not cap payment pages; page views are the only metered unit.
No. PCI Compliance and Client-Side Security are two products, with a discount when both are taken. Our $99 covers both.
Only on Enterprise, along with the REST API and SIEM integration. Webhook alerts are included in our Pro plan at $99 a month.
No human support on Essentials or Standard. Email support starts at Professional, and Enterprise adds a dedicated contact with an SLA. We include email support on the free plan.
30 days on Essentials, 60 on Standard, 90 on Professional and 18 months on Enterprise. We keep evidence packs for 18 months on every paid plan.
At the entry tier it is a dollar cheaper. What differs is the scope that dollar buys: domains, payment pages, retention, support and whether client-side security is included or added on.
Related articles
Comparisons
Best client-side security tools in 2026
Thirteen tools, each with real pros and real cons, and an honest statement of our own bias.
Comparisons
Does Cloudflare make you PCI compliant?
What the WAF, the CDN and Page Shield each do for 6.4.3 and 11.6.1, and what they leave with you.
Comparisons
Best PCI compliance software in 2026
Full-scope platforms and client-side tools are different categories. Both lists, kept apart.
PCI DSS
PCI DSS compliance: a practical guide for 2026
What the standard covers, what changed in v4.0.1, and where the two client-side requirements fit.
See every script on your own checkout.
Install the tag, mark your payment pages, and watch the inventory fill in. Free forever on 1,000 page views a month, no credit card.
Free forever plan. No credit card.