Script monitoring for deposit and withdrawal flows
Deposit pages carry card data, heavy affiliate and analytics tagging, and regulatory attention from more than one direction at once.
Start for free
Talk to an expert
TL;DR
iGaming and the client-side requirements
THE OBLIGATION
PCI DSS 6.4.3 and 11.6.1 have been mandatory since 31 March 2025 for any page where a cardholder enters, reviews or confirms card data.
THE SPECIFIC DIFFICULTY HERE
Affiliate tracking scripts are numerous, change often, and are added by commercial teams under time pressure.
WHAT THE TAG PRODUCES
A script inventory with justifications, a weekly header change record, runtime blocking, and an evidence pack for your assessor.
Short on time? Deposit pages carry affiliate tags nobody on the security team chose.
Third-party script monitoring
Does igaming need PCI DSS script monitoring?
Yes, if you operate any page where a cardholder enters, reviews or confirms card data, which includes pages that embed a payment iframe. Deposit pages carry card data, heavy affiliate and analytics tagging, and regulatory attention from more than one direction at once. Requirements 6.4.3 and 11.6.1 apply to those pages regardless of platform, and have done since 31 March 2025.
Where the exposure is
Affiliate tracking scripts are numerous, change often, and are added by commercial teams under time pressure
Deposit and withdrawal flows are payment pages and are frequently scoped too narrowly
Multiple licensing jurisdictions each ask their own questions about player data
High transaction velocity makes card testing and skimming economically attractive
What the inventory shows you
Every script on deposit, withdrawal and stored-card pages
Affiliate tags reading fields beyond what their tracking requires
Scripts sending player or payment data to destinations outside your approved list
Changes introduced by an affiliate network rather than by your own release
Requirement 6.4.3 is an authorisation record: every script on the payment page, where it came from, and why it is allowed to be there.
The two requirements, in this context
Frequently asked questions
Read the FAQ
Yes. A deposit page where a player enters card details is a payment page, and so is a stored-card management screen. Both belong in scope.
This is the main operational challenge here, and the weekly change queue is the answer: only new and changed scripts surface, so a set that churns is reviewable in minutes rather than audited annually.
No, not directly. This covers PCI DSS 6.4.3 and 11.6.1 and client-side script security. It will tell you what data scripts collect and where they send it, which is often useful evidence in a licensing conversation, but it is not a licensing compliance tool.
Yes, through teams under one organisation, each with its own scope, alerting and evidence.
See the scripts on your own payment pages.
Free forever on 1,000 page views a month, no credit card. Unlimited domains on every plan.
Free forever plan. No credit card.