# Script Monitoring

> Script monitoring for PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1. One first-party JavaScript tag inventories every script executing on your payment pages, verifies each one against the payload you approved, detects changes to the page and its HTTP headers as the consumer browser received them, blocks scripts at runtime, and produces a weekly evidence pack for your assessor.

Key facts: requirements 6.4.3 and 11.6.1 became mandatory on 31 March 2025. 6.4.3 is an authorisation record (inventory, business justification per script, integrity assurance); 11.6.1 is a change-detection record (page and HTTP header changes, alerting personnel, at least every seven days). This product keeps the two as separate records because assessors test them separately. Coverage is 100% of sessions with no sampling. Blocking works by domain, URL, payload hash, or a single capability such as reading form fields. Installation is one first-party tag with no DNS change, no CDN change, and no traffic routed through us; the tag is fail-open and is pinned with Subresource Integrity, so a body we did not publish is rejected by the browser. Deep analysis of each third-party script happens off the page.

Pricing is published: free for 1,000 page views a month, Pro from $99/month for 100,000 payment-page views, $499/month at 500,000 and $799/month at 1,000,000, overage $0.0013 per page view, annual billing at 10 months instead of 12, Enterprise on request. A page view is counted when the monitoring script is loaded on a page within the scope you configured and starts sending telemetry data; blocked requests are never counted. Scripts, domains, vendors, alerts, blocks, teams and users are unlimited on every plan. Controls are QSA-validated.

Scope limits, stated plainly: this covers 2 of the 12 PCI DSS requirement families. It is not a full-scope GRC platform and does nothing about network segmentation, encryption at rest, access control or the other ten families. It is web only, so a native mobile app checkout is outside what a browser tag can observe. It is not a WAF.

## Overview
- [Script Monitoring](https://www.scriptmonitoring.com/): Script monitoring for PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1. Inventory every payment-page script, detect page and header changes, and get a weekly evidence pack.

## Product & pricing
- [Contact](https://www.scriptmonitoring.com/contact/): Get in touch about PCI DSS 6.4.3 and 11.6.1.
- [Watch the demo](https://www.scriptmonitoring.com/demo/): A recorded walkthrough: install the tag, mark your payment pages, and see the inventory and the evidence pack fill in.
- [FAQ](https://www.scriptmonitoring.com/faq/): 503 questions and answers about payment-page script monitoring, the standard, install, evidence, pricing and the alternatives.
- [Pricing | Script Monitoring for PCI DSS 6.4.3 and 11.6.1](https://www.scriptmonitoring.com/pricing/): Free for 1,000 page views a month. Pro from $99/month, overage $0.0013 per page view. Page views are the only metered unit.
- [Security and Trust](https://www.scriptmonitoring.com/security/): How we handle data: what the tag collects, what it deliberately does not, retention periods, and where it runs.

## Platform
- [Platform | Script Inventory, Tamper Detection, Evidence Packs](https://www.scriptmonitoring.com/platform/): The platform: script inventory, tamper detection, header monitoring, vendor load chains, runtime blocking, monitor-only mode, alerts.
- [Alerts | Script Monitoring Platform](https://www.scriptmonitoring.com/platform/alerts/): 11.6.1 asks you to alert personnel. A log nobody is subscribed to does not meet it, and the alert record is what an assessor asks to see.
- [How it works | Script Monitoring Platform](https://www.scriptmonitoring.com/platform/architecture/): One first-party tag reports what scripts do in the live session. The scripts themselves are fetched from our side to be hashed, archived and analysed.
- [Weekly evidence packs | Script Monitoring Platform](https://www.scriptmonitoring.com/platform/evidence-packs/): One PDF covering both client-side requirements, generated weekly, containing what an assessor actually asks for rather than a screenshot of a dashboard.
- [Header monitoring | Script Monitoring Platform](https://www.scriptmonitoring.com/platform/header-monitoring/): A loosened Content-Security-Policy changes what the browser will permit and is invisible in the page body.
- [Monitor-only mode | Script Monitoring Platform](https://www.scriptmonitoring.com/platform/monitor-only-mode/): The same evidence you would get with enforcement on, including exactly what would have been blocked and on which pages, with nothing actually stopped.
- [PCI dashboard | Script Monitoring Platform](https://www.scriptmonitoring.com/platform/pci-dashboard/): Vendors on one tab for 6.4.3, headers on another for 11.6.1. The split is deliberate, because merging them loses the distinction an assessor is testing.
- [Script blocking | Script Monitoring Platform](https://www.scriptmonitoring.com/platform/script-blocking/): Monitoring that can only describe a problem leaves you filing a ticket while the script keeps running.
- [Script inventory | Script Monitoring Platform](https://www.scriptmonitoring.com/platform/script-inventory/): The inventory starts as a complete record of every script observed in a real session, not a list of the tags you remember adding.
- [Tamper detection | Script Monitoring Platform](https://www.scriptmonitoring.com/platform/tamper-detection/): A payment page legitimately varies between visitors. Tamper detection has to separate variance from change, or it produces noise nobody reads.
- [Vendors and load chains | Script Monitoring Platform](https://www.scriptmonitoring.com/platform/vendor-management/): You approved a vendor. The vendor loaded two more. The browser treats all three identically, and so does PCI DSS 6.4.3.

## Use cases
- [Client-Side Security: What a WAF Cannot See](https://www.scriptmonitoring.com/client-side-security/): Client-side security covers attacks that happen in the visitor's browser rather than on your servers.
- [JavaScript Monitoring for Security and PCI DSS](https://www.scriptmonitoring.com/javascript-monitoring/): Security JavaScript monitoring: which scripts execute, whether the payload changed, what they touch, and where they send data.
- [Magecart Protection: Detect and Block Skimmers](https://www.scriptmonitoring.com/magecart-protection/): Magecart attacks add a script to your checkout that reads card fields and posts them elsewhere.
- [Payment Page Security and Page Integrity](https://www.scriptmonitoring.com/payment-page-security/): What counts as a payment page, why the page around a payment iframe is still in scope, and how to assure page integrity across scripts.
- [PCI Compliance Software for 6.4.3 and 11.6.1](https://www.scriptmonitoring.com/pci-compliance-software/): PCI compliance software for the client-side requirements. Inventory payment-page scripts for 6.4.3, detect header and page changes for 11.6.1.
- [PCI DSS 11.6.1: Change and Tamper Detection](https://www.scriptmonitoring.com/pci-dss-11-6-1/): PCI DSS 11.6.1 requires a change- and tamper-detection mechanism that alerts on unauthorised changes to payment page HTTP headers and content.
- [PCI DSS 6.4.3: Payment Page Script Inventory](https://www.scriptmonitoring.com/pci-dss-6-4-3/): PCI DSS 6.4.3 requires an inventory of every payment-page script with a written justification and integrity assurance.
- [Third-Party Script Monitoring](https://www.scriptmonitoring.com/third-party-script-monitoring/): Monitor every third-party script on your site, including the ones your vendors load. Identity, integrity, behaviour and change over time, from real sessions.
- [Use Cases | PCI DSS 6.4.3, 11.6.1 and Client-Side Security](https://www.scriptmonitoring.com/use-cases/): What teams use script monitoring for: PCI DSS 6.4.3 and 11.6.1 compliance, Magecart and web skimming protection, third-party script inventory.
- [Web Skimming and E-Skimming Protection](https://www.scriptmonitoring.com/web-skimming-protection/): Web skimming, e-skimming and digital skimming are one attack: a script reading card fields in the browser.

## Comparisons (alternatives)
- [Akamai Page Integrity Manager Alternative](https://www.scriptmonitoring.com/alternative-to-akamai-page-integrity-manager/): An honest comparison of Akamai Page Integrity Manager, now Client-Side Protection & Compliance, for PCI DSS 6.4.3 and 11.6.1: what it does well, where it has limits, and which one to choose.
- [Cloudflare Page Shield Alternative](https://www.scriptmonitoring.com/alternative-to-cloudflare-page-shield/): An honest comparison of Cloudflare Page Shield, now Client-Side Security, for PCI DSS 6.4.3 and 11.6.1: published pricing, what it does well, where it has limits, and which one to choose.
- [cside Alternative](https://www.scriptmonitoring.com/alternative-to-cside/): An honest cside comparison for PCI DSS 6.4.3 and 11.6.1: identical pricing up to 500,000 page views and published above it, the script proxy in your checkout path, inline script coverage, and which one to choose.
- [DomDog Alternative](https://www.scriptmonitoring.com/alternative-to-domdog/): An honest DomDog comparison for PCI DSS 6.4.3 and 11.6.1: what it does well, where it has limits, and which one to choose.
- [F5 Client-Side Defense Alternative](https://www.scriptmonitoring.com/alternative-to-f5-client-side-defense/): An honest F5 Client-Side Defense comparison for PCI DSS 6.4.3 and 11.6.1: what it does well, where it has limits, and which one to choose.
- [Feroot Alternative](https://www.scriptmonitoring.com/alternative-to-feroot/): An honest Feroot comparison for PCI DSS 6.4.3 and 11.6.1: what it does well, where it has limits, and which one to choose.
- [Imperva Client-Side Protection Alternative](https://www.scriptmonitoring.com/alternative-to-imperva-client-side-protection/): An honest Imperva Client-Side Protection comparison for PCI DSS 6.4.3 and 11.6.1: what it does well, where it has limits, and which one to choose.
- [Jscrambler Alternative](https://www.scriptmonitoring.com/alternative-to-jscrambler/): An honest Jscrambler comparison for PCI DSS 6.4.3 and 11.6.1: what it does well, where it has limits, and which one to choose.
- [Reflectiz Alternative](https://www.scriptmonitoring.com/alternative-to-reflectiz/): An honest Reflectiz comparison for PCI DSS 6.4.3 and 11.6.1: what it does well, where it has limits, and which one to choose.
- [Report URI Alternative](https://www.scriptmonitoring.com/alternative-to-report-uri/): An honest Report URI comparison for PCI DSS 6.4.3 and 11.6.1: what it does well, where it has limits, and which one to choose.
- [Source Defense Alternative](https://www.scriptmonitoring.com/alternative-to-source-defense/): An honest Source Defense comparison for PCI DSS 6.4.3 and 11.6.1: what it does well, where it has limits, and which one to choose.
- [Client-Side Security Comparisons](https://www.scriptmonitoring.com/alternatives/): Honest comparisons against 13 client-side security and PCI DSS 6.4.3 tools, each with a real strength, a real limitation.

## Industries
- [AI startups: PCI DSS Script Monitoring](https://www.scriptmonitoring.com/industries/ai-startups/): You added self-serve billing in a week, instrumented everything, and then an enterprise buyer sent a security questionnaire asking about client-side script.
- [Airlines and transit: PCI DSS Script Monitoring](https://www.scriptmonitoring.com/industries/airlines/): A booking flow is long, multi-step, and carries more third-party code than almost any other checkout: seat maps, ancillaries, insurance, loyalty.
- [Ecommerce: PCI DSS Script Monitoring](https://www.scriptmonitoring.com/industries/ecommerce/): Your checkout runs code from analytics, chat, personalisation, reviews, affiliates and a tag manager that loads more of them.
- [Healthcare: PCI DSS Script Monitoring](https://www.scriptmonitoring.com/industries/healthcare/): A healthcare payment page often carries PHI as well as card data, so a leaking third-party script is a PCI problem and a HIPAA problem at the same time.
- [Higher education: PCI DSS Script Monitoring](https://www.scriptmonitoring.com/industries/higher-education/): A university is a federation of departments that each built their own payment page.
- [Hospitality: PCI DSS Script Monitoring](https://www.scriptmonitoring.com/industries/hospitality/): Many properties, several booking engines, one compliance scope to prove. Unlimited domains on every plan is the feature that matters most here.
- [iGaming: PCI DSS Script Monitoring](https://www.scriptmonitoring.com/industries/igaming/): Deposit pages carry card data, heavy affiliate and analytics tagging, and regulatory attention from more than one direction at once.
- [Insurance: PCI DSS Script Monitoring](https://www.scriptmonitoring.com/industries/insurance/): A quote-and-buy flow collects more third-party code than almost any other checkout, because comparison, chat.
- [Nonprofits and fundraising: PCI DSS Script Monitoring](https://www.scriptmonitoring.com/industries/nonprofits/): A donation page is a payment page with a marketing team attached. It carries more tracking code than most checkouts because attribution is how campaigns get.
- [Payment providers: PCI DSS Script Monitoring](https://www.scriptmonitoring.com/industries/payments/): Your merchants inherit your compliance posture and ask you about theirs. An organisation layer.
- [SaaS and software: PCI DSS Script Monitoring](https://www.scriptmonitoring.com/industries/saas/): Your payment page is usually a modal inside the product, which is why it is often the last page anyone thinks to scope.
- [Ticketing and events: PCI DSS Script Monitoring](https://www.scriptmonitoring.com/industries/ticketing/): Ticketing is where client-side attacks became a boardroom subject. The checkout is short, the traffic is spiky, and the page is usually carrying chat.

## For your team
- [Compliance and audit](https://www.scriptmonitoring.com/teams/compliance/): The output of a client-side control is not a dashboard, it is something you can hand over. That is what the weekly evidence pack is for.
- [Engineering](https://www.scriptmonitoring.com/teams/engineering/): No routing change, no CDN change, no build-step dependency, and fail-open by design so we can never take your checkout down.
- [Security](https://www.scriptmonitoring.com/teams/security/): An alert that says 'suspicious activity detected' starts an investigation. An alert with the script, the hash, the call stack and the archived payload ends one.

## Guides & explainers
- [Blog | PCI DSS, Client-Side Security and Script Monitoring](https://www.scriptmonitoring.com/blog/): Writing on PCI DSS 6.4.3 and 11.6.1, Magecart and web skimming, Content Security Policy, and client-side security, for compliance.
- [Best Client-Side Security Tools in 2026](https://www.scriptmonitoring.com/blog/best-client-side-security-tools/): Thirteen client-side security and PCI DSS 6.4.3 tools compared, each with real pros, real cons and a clear best-for. Includes our own product, disclosed.
- [Best PCI Compliance Software in 2026](https://www.scriptmonitoring.com/blog/best-pci-compliance-software/): Two different product categories share this name: full-scope GRC platforms and client-side tools for 6.4.3 and 11.6.1.
- [Cloudflare Page Shield pricing](https://www.scriptmonitoring.com/blog/cloudflare-page-shield-pricing/): Page Shield, now Cloudflare Client-Side Security, is on every plan, but the alerts PCI 11.6.1 needs sit on the Advanced add-on at $0.099 per 1,000 requests. What is included where, and what it really costs.
- [Does Cloudflare Make You PCI Compliant?](https://www.scriptmonitoring.com/blog/cloudflare-pci-compliance/): What Cloudflare's CDN, WAF and Page Shield actually cover for PCI DSS, where requirements 6.4.3 and 11.6.1 land.
- [Content Security Policy: A Complete Guide for 2026](https://www.scriptmonitoring.com/blog/content-security-policy/): What a Content Security Policy does, how to deploy one without breaking your site, the directives that matter, and the gap a CSP leaves open on payment pages.
- [CSP vs Script Monitoring: Two Controls, Different Jobs](https://www.scriptmonitoring.com/blog/csp-vs-script-monitoring/): A Content Security Policy governs where scripts load from. Script monitoring governs what they do. Where each one stops, and why PCI DSS 6.4.3 needs both.
- [Feroot pricing](https://www.scriptmonitoring.com/blog/feroot-pricing/): Feroot does not publish pricing. What drives the quote, what to ask for, and an honest comparison against figures that are published.
- [Homoglyph Attacks: When a Domain Is Not the Domain](https://www.scriptmonitoring.com/blog/homoglyph-attack/): Homoglyph attacks use characters that render identically to trick people and allowlists.
- [Hosted Payment Pages, Iframes and PCI Scope](https://www.scriptmonitoring.com/blog/hosted-payment-page-pci/): What a hosted payment page is, how much scope an iframe actually removes, and why the page hosting it stays in scope for PCI DSS 6.4.3 and 11.6.1.
- [How to Comply with PCI DSS 6.4.3 and 11.6.1](https://www.scriptmonitoring.com/blog/how-to-comply-with-pci-dss-6-4-3-and-11-6-1/): A step-by-step method for the two client-side PCI requirements: define payment-page scope, build the inventory, write justifications, detect change.
- [How to Deobfuscate JavaScript: A Step-by-Step Method](https://www.scriptmonitoring.com/blog/how-to-deobfuscate-javascript/): A practical method for unpacking an obfuscated third-party script: preserve the bytes, recover the string table, substitute the decoder calls.
- [JavaScript Injection Attacks, Explained](https://www.scriptmonitoring.com/blog/javascript-injection/): How arbitrary JavaScript gets onto a page you control: the four routes that matter, why third-party compromise is the most common, and what addresses each one.
- [JavaScript Obfuscation and De-obfuscation](https://www.scriptmonitoring.com/blog/javascript-obfuscation/): Why malicious scripts are obfuscated, the techniques used, how they are unpacked, and why obfuscation is a weak security control for your own code.
- [JavaScript Security: The Client-Side Threat Model](https://www.scriptmonitoring.com/blog/javascript-security/): What actually goes wrong in the browser, which controls address which failure, and why third-party code is the part of the threat model most teams underweight.
- [Jscrambler Pricing: What Is Published and What Is Not](https://www.scriptmonitoring.com/blog/jscrambler-pricing/): Jscrambler does not publish pricing. What drives a quote, what to ask for on the call, and how it compares to published alternatives.
- [Magento and Adobe Commerce PCI Compliance](https://www.scriptmonitoring.com/blog/magento-pci-compliance/): Magento checkouts were the original Magecart target. What self-hosting means for PCI scope, where 6.4.3 lands, and the extension problem.
- [How to Build a Payment-Page Script Inventory](https://www.scriptmonitoring.com/blog/payment-page-script-inventory/): A practical method for the 6.4.3 inventory: start from what actually executed, capture the load chain, write justifications per script.
- [PCI Compliance Cost: What Drives the Bill in 2026](https://www.scriptmonitoring.com/blog/pci-compliance-cost/): What PCI compliance actually costs by merchant level and SAQ type, which costs are one-off, and where the client-side requirements land as a line item.
- [PCI DSS 4.0.1 Requirements: What Changed and When](https://www.scriptmonitoring.com/blog/pci-dss-4-0-1-requirements/): What PCI DSS v4.0 and v4.0.1 changed, which dates have already passed, and the two requirements most often left open at a first assessment.
- [PCI DSS Compliance: A Practical Guide for 2026](https://www.scriptmonitoring.com/blog/pci-dss-compliance/): What PCI DSS covers, what changed in v4.0.1, the SAQ types, and where the two client-side requirements introduced in v4.0 actually fit.
- [SAQ A and the Script Requirements: Who Is Exempt](https://www.scriptmonitoring.com/blog/pci-dss-saq-a/): The January 2025 SAQ A update exempted merchants from certain requirements, with a condition attached.
- [Reflectiz pricing](https://www.scriptmonitoring.com/blog/reflectiz-pricing/): Reflectiz does not publish pricing. What drives the quote, what to ask for, and an honest comparison against figures that are published.
- [Shadow Code: The Scripts Nobody Approved](https://www.scriptmonitoring.com/blog/shadow-code/): Shadow code is JavaScript executing on your pages that nobody on your team chose. Where it comes from, why inventories miss it, and what to do about it.
- [Shopify PCI Compliance: What Is Actually Yours to Do](https://www.scriptmonitoring.com/blog/shopify-pci-compliance/): Shopify handles a great deal of PCI compliance for you. What remains yours, where requirement 6.4.3 lands on a hosted platform.
- [Source Defense pricing](https://www.scriptmonitoring.com/blog/source-defense-pricing/): Source Defense publishes four tiers, from $98/month. What each plan includes, where the limits bite, and an honest comparison against ours.
- [Subresource Integrity: What SRI Solves and What Breaks](https://www.scriptmonitoring.com/blog/subresource-integrity/): Subresource Integrity pins the exact contents of a file by hash. Why it is excellent for static assets, why it is almost unusable for third-party tags.
- [Tag Manager Security: GTM, Adobe and Tealium](https://www.scriptmonitoring.com/blog/tag-manager-security/): A tag container is a mechanism for injecting arbitrary JavaScript by design. How to secure Google Tag Manager, Adobe and Tealium.
- [What Is Formjacking? The Mechanism, Explained](https://www.scriptmonitoring.com/blog/what-is-formjacking/): Formjacking is the hijacking of a web form to steal what is typed into it. The two implementations, how each is detected.
- [What Is Magecart? Groups, Methods and Real Incidents](https://www.scriptmonitoring.com/blog/what-is-magecart/): Magecart is the umbrella name for groups injecting card-skimming JavaScript into checkout pages.
- [What Is Web Skimming? How Card Data Leaves the Browser](https://www.scriptmonitoring.com/blog/what-is-web-skimming/): Web skimming, e-skimming and digital skimming are one technique. How the script reads the form, the exfiltration methods used.

## Optional
- [Log in](https://www.scriptmonitoring.com/login/): Sign in to the console.
- [Privacy Policy](https://www.scriptmonitoring.com/privacy/): What we collect when you use Script Monitoring, what our tag does and does not record on your payment pages, and the rights you have.
- [Start for free](https://www.scriptmonitoring.com/signup/): 1,000 page views a month, forever, with both PCI requirements included. No credit card.
- [Status](https://www.scriptmonitoring.com/status/): Service status and uptime.
- [Terms of Service](https://www.scriptmonitoring.com/terms/): The agreement between you and Script Monitoring, Inc. for using the platform.