How Do You Monitor Fourth-Party Scripts Your Vendors Load?
A third party is a vendor whose script you added; a fourth party is a script that vendor loaded. You have no contract with them and full exposure, and PCI DSS 6.4.3 applies to every script that executes on a payment page. This video shows how to see who loaded whom, why a tag manager container is judged by what it loaded rather than its name, and the four things to monitor for every script in the chain: identity and load chain, payload integrity, runtime behaviour and change over time.
Full answer: Third-Party Script Monitoring and Management
Transcript
To monitor fourth-party scripts, watch the browser, not your vendor list. Record every script that runs in real sessions, with the script that loaded it, and get an alert when what it does changes. Here's why. You approve one vendor. It loads two more, and one of those loads another. All of them run with the same privileges as your own code. A third party is a vendor whose script you added. A fourth party is a script that vendor loaded. You have no contract with them, often no visibility, and full exposure. So approving a vendor is not approving a script. On payment pages, PCI DSS 6.4.3 applies to every script that executes, whoever added it. Tag managers are the noisiest source we see. An attacker doesn't need your container: they can inject through another one loaded as a sub-request, so the origin still reads as Google. Judge it by what it loaded, not its name. So lock the container down: MFA on every account, publish rights for a few named people, a second person to approve each publish, and limits on custom HTML tags. For every script in the chain, monitor four things: identity and load chain, payload integrity, runtime behaviour, and change over time. Most tools stop at the first. Integrity is where allowlists fail. A vendor can change what a file contains without changing its address, and an origin allowlist won't notice. Pin approval to the payload, not the URL. Behaviour is what a script does once it runs: what it touches on the page, whether it reads form fields, and where it sends data. An analytics script can read your payment form as easily as your checkout code can. The script that behaved for six months and changed last Tuesday is the interesting case. So review only what changed: new scripts, new destinations, changed code. About ten minutes a week. Script Monitoring does this from one tag, reporting every script in every session. On Pro, it also draws the full vendor load chain. Script Monitoring is free for 1,000 page views a month. Pro, with the load chain and guardrails, starts at $99 a month. Start for free at scriptmonitoring.com.