Script monitoring for donation and fundraising pages
A donation page is a payment page with a marketing team attached. It carries more tracking code than most checkouts because attribution is how campaigns get funded.
Start for free
Talk to an expert
TL;DR
Nonprofits and fundraising and the client-side requirements
THE OBLIGATION
PCI DSS 6.4.3 and 11.6.1 have been mandatory since 31 March 2025 for any page where a cardholder enters, reviews or confirms card data.
THE SPECIFIC DIFFICULTY HERE
Donation pages carry advertising pixels, attribution tags and A/B testing tools, all added for good reasons and all executing where the card is typed.
WHAT THE TAG PRODUCES
A script inventory with justifications, a weekly header change record, runtime blocking, and an evidence pack for your assessor.
Short on time? A donation page is a payment page, and charitable status changes nothing.
Requirement 6.4.3
Does nonprofits and fundraising need PCI DSS script monitoring?
Yes, if you operate any page where a cardholder enters, reviews or confirms card data, which includes pages that embed a payment iframe. A donation page is a payment page with a marketing team attached. It carries more tracking code than most checkouts because attribution is how campaigns get funded. Requirements 6.4.3 and 11.6.1 apply to those pages regardless of platform, and have done since 31 March 2025.
Where the exposure is
Donation pages carry advertising pixels, attribution tags and A/B testing tools, all added for good reasons and all executing where the card is typed
Campaign microsites are built quickly on their own domains, take cards, and are rarely reviewed again after launch
Peer-to-peer and event fundraising pages are created by supporters, not staff, on templates nobody re-checks
A small team with no dedicated security function still carries the same 6.4.3 and 11.6.1 obligation as a retailer
What the inventory shows you
Every script on donation, campaign and peer-to-peer pages, across unlimited domains
Advertising and A/B testing tags reading donation form fields
A fundraising platform or payment widget shipping changed code, caught by payload hash
New campaign pages appearing with tags that were never authorised on the main donation flow
Requirement 6.4.3 is an authorisation record: every script on the payment page, where it came from, and why it is allowed to be there.
The two requirements, in this context
Frequently asked questions
Read the FAQ
Yes. The requirements follow any page where a cardholder enters, reviews or confirms card data, and a donation form is exactly that. Charitable status changes nothing about the obligation.
It depends on where the form lives, and this is worth checking rather than assuming. If the donation form is hosted on your domain, the page is your scope. If the platform hosts it entirely on theirs, it is theirs, though the page you send donors from can still matter.
Yes, and temporary is the risk rather than the excuse. A microsite launched for one appeal, tagged heavily for attribution and never reviewed again, is the least-watched payment page most organisations run.
No. Monitoring changes nothing by default, and monitor-only mode records what would have been blocked without stopping anything. When you do act, block a single capability rather than the whole tag, so attribution keeps working while losing the ability to read the donation form.
Usually whoever owns the website, and it is built for that. Install is one tag, alerts go to email or a webhook into whatever chat tool you use, and the evidence pack is generated rather than assembled.
Yes, get in touch. The free plan is permanent at 1,000 page views a month with both requirements included, and we would rather you asked than assumed not.
Yes, if they are on a domain you control, and they are unlimited. Domains are never a billing dimension.
No. Payment-page URL patterns can be imported in bulk by CSV or through the REST API, which is how platforms with large domain lists set up. Compile the list of client URLs that need PCI configuration once, import it, and new campaigns follow the same pattern rules.
The same visibility applies, though the requirement does not. A tag that can read a card field can read a name, an address or a gift amount, and that is a data protection question your privacy notice has to answer even where PCI DSS does not reach.
See the scripts on your own payment pages.
Free forever on 1,000 page views a month, no credit card. Unlimited domains on every plan.
Free forever plan. No credit card.