Is Session Replay Safe on Payment Pages?
Session replay is built to capture what is on the page and what the visitor types, which is the capability a skimmer needs. No replay tool is safe on a payment page just by default. This video covers what the main tools mask by default (as published in November 2026), what masking does not cover, and the six-point setup an assessor will accept if replay has to stay on checkout under PCI DSS 6.4.3 & 11.6.1.
Full answer: Session Replay on Payment Pages: Is It PCI Safe?
Transcript
No session replay tool is safe on a payment page just by default. The safest setup is not to load it there. If you must, keep card entry in your provider's iframe, and treat the replay script like any other payment-page script. Script Monitoring is one tag that shows every script running on your payment pages, from real sessions, replay tools included. First, find out whether replay runs there. Tag manager settings won't tell you, because tags often fire everywhere. Look at what executes in real sessions. Most scripts on a checkout read a page view or a click. Session replay is built to capture what's on the page and what the visitor does, including typing. That's the capability a skimmer needs, already installed and already trusted. The major tools do mask by default. As published in November 2026, FullStory, Microsoft Clarity, Contentsquare and Quantum Metric all mask or exclude form inputs or card fields. Defaults change, so check your own settings. But masking runs inside the replay script, in the browser. A changed version of that script, from the vendor or an attacker, decides for itself what to send. And a custom card field can fall outside the rule. Masking is a data-handling setting. It isn't an inventory entry, a justification or change detection, which is what 6.4.3 & 11.6.1 ask for. Even with an iframe, the page around it stays in scope. If replay has to stay, this holds up. Card entry in your provider's iframe. Exclude the payment form, don't just mask it. Load replay only where needed. Inventory and justify it. Monitor it for changes and new destinations. And restrict who can change its configuration. Change detection matters more than the masking setting. A compromised replay script could skim cards. When its code changes, the same address now serves a different script, and that should raise an alert under 11.6.1. Script Monitoring keeps the replay script in your weekly evidence pack, with its justification and every alert raised. See which scripts read your payment form today. Script Monitoring is free for 1,000 page views a month, and Pro starts at $99 a month. Start for free at scriptmonitoring.com.