The scripts on your checkout.Authorised and checked daily
PollySec renders your payment page like a shopper's browser does, lists the scripts it loads for you to authorise, checks the code they ran every day, and alerts your administrators when a script or security header changes.
Payment-page script inventory
- cdn.payments.example/iframe.jsAuthorised
- widgets.reviews.example/badge.jsAuthorised
- tags.analytics.example/collect.jsChanged since baseline
- static.unknown-cdn.example/x.jsNew · not authorised
6.4.3 inventory · 11.6.1 change detection
The checkoutis the target
Card data is increasingly stolen in the shopper's browser, by a tampered script on the payment page. PCI DSS v4.0.1 answers with 6.4.3 and 11.6.1. PollySec supports both with evidence from outside, and supplies findings toward 4.2.1, 6.3.1, 6.3.3 and internal scanning (11.3.1).
Script inventory
Every script the payment page loads by address, yours and third parties', found in a real browser, each with the integrity control it carries.
Authorisation
Authorise each script with a written justification. Every decision is kept, a script whose code changes goes back for review, and the register exports as evidence.
Change detection
The payment page is checked in a real browser every day, never more than five days apart. The code each script ran, inline scripts included, and the security headers are compared with a baseline you approve. A change e-mails your administrators at once.
Encryption
TLS strength, certificate validity and outdated protocols.
Outdated software
Components past vendor security support, and known vulnerabilities in what you run.
Internal scanning
From inside the network, via the on-site sensor.
Change detection runs on a schedule, against the page as an anonymous shopper sees it, or signed in with a saved login session. It is not real-time monitoring of every session: a script served only to some visitors, or changed and changed back between two checks, can be missed. Since 31 March 2025 SAQ A no longer lists 6.4.3 and 11.6.1; instead the merchant confirms, as an eligibility criterion, that its site is not susceptible to attacks from scripts that could affect its e-commerce systems. Your acquirer and QSA decide how compliance is validated.
Checkout, surface,network
The same platform watches the rest of what an attacker would try first. It also produces a PCI DSS v4.0.1 evidence report, plus a dedicated 6.4.3 payment-script report.
External surface
Exposed services, admin pages and weak TLS across your public footprint.
Checked by ARIA
Serious findings re-tested on the live target where a test settles it, and you see the verdict with the evidence.
NIS2 & ISO 27001
The same data feeds your NIS2 and ISO 27001 reports.
Catch the change nobody approved
We'll render a real payment page with you and show the script register on the spot.
Book a demo