Authenticated Monitoring: see the payment pages behind your login

Many payment steps only appear after sign-in or in the middle of a checkout. With Authenticated Intelligent Monitoring™, PCI Monitor records your login and checkout once, then replays that journey in a real browser on every test and records the scripts at each step.

A check of public pages cannot reach what sits behind a login

PCI DSS 11.6.1 is about the HTTP headers and the contents of payment pages as the consumer's browser receives them. If your payment form appears only after signing in, or on a step in the middle of a checkout, a monitor that loads public addresses never evaluates that page. The scripts that matter most, the ones next to the card field, are the ones it does not see.

How it works

Record once

You sign in and walk through the checkout in a recording window, the way a customer would. Nothing to install on your site.

Replay on every test

Each scheduled test replays the journey in a real headless browser, so scripts that load only when the page runs are seen. You can watch a test live.

Scripts at every step

The scripts are recorded at each step, including pages that only appear mid-flow, such as verification screens and payment steps.

Compare and alert

Every script is compared with your approved baseline. When something is added, removed or changed, the people you chose are alerted, and each decision is recorded with who made it and when.

Sign-in methods it can follow

A monitor can hold several logins (for example Admin, Customer and Support), each with its own method. The credentials are stored encrypted.

  • A username and password, with no second step.
  • An email address as the username: PCI Monitor creates an inbox for the test login.
  • A one-time code sent by email after sign-in: the inbox receives it.
  • A one-time code sent by text message.
  • An authenticator app (time-based codes).

What you can show an assessor

  • A dated history of every test, with the scripts found at each step of the journey.
  • The decision on each script (approved or unsafe), the written reason, who decided and when.
  • Alerts when a script is added, removed or changed, and what happened next.
  • A compliance report from each compliance test, and an evidence API for your compliance platform.
  • An audit log of changes that each company can read.

What to know

  • PCI Monitor detects and reports. It does not block or prevent changes on your site.
  • A recording shows what a browser did on the day it was made. If the journey changes (a moved button, a new step), the recording must be redone: PCI Monitor tells you when tests stop matching it.
  • PCI DSS compliance depends on your whole program and is confirmed by your assessor. PCI Monitor helps you meet requirements 11.6.1 and 6.4.3.

See what runs behind your login

Start with a free script check of any public page, or start a free trial and record your first journey.