Shopify or Magento: Which PCI DSS 6.4.3 & 11.6.1 Work Is Yours?

Transcript

On both platforms, the scripts you add to checkout are yours, and so is PCI DSS 6.4.3 & 11.6.1. Shopify carries most of the rest of the standard. On self-hosted Magento, almost the whole stack is yours. Why now? Since 2025, 6.4.3 & 11.6.1 cover the scripts on pages where a cardholder enters card data. Apps, theme code and extensions are scripts. Shopify is PCI DSS compliant as a platform and service provider. That covers payment processing, card data, and hosting. It doesn't make your store compliant. Your apps, theme code, tag manager and admin access are yours. Apps are the main source. An app that adds a storefront feature usually does it by injecting JavaScript. You approved the app, not its script. And uninstalled apps often leave their script tags behind. Check three things. Do you use checkout extensions? Do apps inject script into checkout or the order status page? Do your marketing tags fire on cart and checkout? Each yes adds scripts to justify. Plus stores carry more of this. Magento is software, not a service, so it can't be compliant on your behalf. Self-hosted, the server, the patching, the extensions and the code are all yours. Adobe Commerce on cloud shifts some hosting, but checkout scripts stay yours. Extensions are the biggest risk. Thirty extensions means trusting thirty codebases with the checkout. Each can load more code from its vendor at runtime, and some stay installed long after their author abandons them. On either platform, start the inventory from what runs on cart and checkout in real sessions, not from your app or extension list. Write a justification per script. Enforce MFA on admin. And on Magento, patch core promptly. On either platform, Script Monitoring shows what needs you today: open alerts, vendors nobody has reviewed, and the top risks. Add the tag through your theme or tag manager. It's free for 1,000 page views a month, and Pro starts at $99 a month. Start for free at scriptmonitoring.com.