Script monitoring across hotel and hospitality booking engines
Many properties, several booking engines, one compliance scope to prove. Unlimited domains on every plan is the feature that matters most here.
Start for free
Talk to an expert
TL;DR
Hospitality and the client-side requirements
THE OBLIGATION
PCI DSS 6.4.3 and 11.6.1 have been mandatory since 31 March 2025 for any page where a cardholder enters, reviews or confirms card data.
THE SPECIFIC DIFFICULTY HERE
Each property or brand may run a different booking engine and a different tag set.
WHAT THE TAG PRODUCES
A script inventory with justifications, a weekly header change record, runtime blocking, and an evidence pack for your assessor.
Short on time? Stored-card pages are the most commonly missed scope.
What counts as a payment page
Does hospitality need PCI DSS script monitoring?
Yes, if you operate any page where a cardholder enters, reviews or confirms card data, which includes pages that embed a payment iframe. Many properties, several booking engines, one compliance scope to prove. Unlimited domains on every plan is the feature that matters most here. Requirements 6.4.3 and 11.6.1 apply to those pages regardless of platform, and have done since 31 March 2025.
Where the exposure is
Each property or brand may run a different booking engine and a different tag set
Franchise and management structures blur who owns the compliance obligation
Loyalty and upsell integrations add scripts to the payment step
Card details are often stored for incidentals, so stored-card pages are in scope too
What the inventory shows you
Every property domain under one organisation, with per-brand team separation
Stored-card management pages, which are in scope and frequently forgotten
Booking-engine scripts that differ between properties when they should not
A single evidence pack per brand, or one across the estate
Requirement 6.4.3 is an authorisation record: every script on the payment page, where it came from, and why it is allowed to be there.
The two requirements, in this context
Frequently asked questions
Read the FAQ
This is the common case: domains are unlimited on every plan, so you pay for page views across the estate rather than per property.
No. The tag is engine-agnostic. Where a property uses an engine you cannot modify, the usual route is the tag manager already present on the property site.
Yes, and they are the most commonly missed. Any page where a cardholder enters, reviews or confirms card data is a payment page, which includes adding or editing a saved card for incidentals.
Yes, through teams. Each brand can be scoped separately with its own evidence pack, under one organisation for central oversight.
See the scripts on your own payment pages.
Free forever on 1,000 page views a month, no credit card. Unlimited domains on every plan.
Free forever plan. No credit card.