A PCI dashboard split the way assessors ask
Vendors on one tab for 6.4.3, headers on another for 11.6.1. The split is deliberate, because merging them loses the distinction an assessor is testing.
Start for free
Talk to an expert
What is pci dashboard?
The PCI dashboard presents the two client-side requirements as two separate records: a vendor and script view for 6.4.3, and a header change view for 11.6.1. Most tools present a single merged PCI report. That reflects how the vendor thinks about the feature rather than how the standard is assessed. 6.4.3 asks what is authorised and why; 11.6.1 asks what changed and who was told. Those are different questions with different evidence, and keeping them apart from the start is what makes the output usable.
The vendors tab, for 6.4.3
Every vendor and script in payment-page scope, its state, its justification, and its payload hash. Anything requiring action sorts to the top, because that is the working queue.
The headers tab, for 11.6.1
Each monitored header with the distinct values observed in the period. One value means stable, more than one means changed, with timestamps and the alert that went out.
Scope is explicit and visible
The dashboard shows every page treated as a payment page and the selector rule that put it there. That named scope is what both requirements are measured against, so it is shown rather than assumed. A domain with no selector configured is flagged, because that state looks identical to a healthy domain with no traffic.
Requirement 6.4.3 is an authorisation record: every script on the payment page, where it came from, and why it is allowed to be there.
Related platform capabilities
Script inventory
Every script, with a justification per script.
Tamper detection
Content and integrity changes on the page.
Header monitoring
Distinct values seen per header, per week.
Vendors and load chains
Who loaded whom, and from where.
Script blocking
By URL, hash, domain, or single action.
Monitor-only mode
The same evidence, nothing stopped.
Frequently asked questions
Read the FAQ
Because they are assessed separately. 6.4.3 is an authorisation record and 11.6.1 is a change-detection record. An assessor asks about them as two controls, and a single merged report makes you disentangle them under time pressure.
Yes, explicitly, along with the selector rule that matched each one, and a list of pages excluded and why. Scope disputes are easier to settle with the list in front of you.
You are warned prominently. Without a selector there is no inventory to attach to 6.4.3 and no named page to watch for 11.6.1, and that state is visually identical to a healthy domain that has had no traffic, which is exactly the kind of silent failure worth shouting about.
Yes. The 6.4.3 and 11.6.1 dashboard is included on every plan including free. It is not an upsell.
See it on your own payment pages.
Install the tag, mark your payment pages, and watch the inventory fill in. Free forever on 1,000 page views a month, no credit card.
Free forever plan. No credit card.