Client-Side Script Integrity Monitoring for PCI DSS 11.6.1 & 6.4.3 — and Every Page That Matters

Client-side scripts are one of the biggest blind spots in modern web security, and most tools only see what's publicly visible. With Authenticated Intelligent Monitoring™, you capture the entire authentication flow and the full checkout sequence from start to finish. PCI Monitor replays that journey on every test and records the scripts at each step — including pages that only appear mid-flow, such as verification screens or payment steps. It detects when a script is added, removed, changed, or tampered with, flags missing or weak security headers, and shows which third-party domains a page contacts. Use it to meet PCI DSS 11.6.1 and 6.4.3 on your payment pages, or to monitor any page where script integrity and tamper detection truly matter, with the approvals and evidence to show for it.

Why PCI Monitor exists

PCI DSS 11.6.1 and 6.4.3 ask you to know which scripts run on your payment pages, to approve each one, and to be told when something changes. Pages like these often sit behind a login, where a public scan can't see them. PCI Monitor tests them the way a customer sees them. The same questions matter for any page that runs scripts from other companies: which scripts run, who approved them, and when did one change?

Features

Authenticated Intelligent Monitoring™

Capture the entire authentication flow and the full checkout sequence from start to finish. PCI Monitor replays that journey on every test and records the scripts at each step, including pages that only appear mid-flow, such as verification screens or payment steps. A monitor can have several logins.

Script monitoring (11.6.1)

Compares every script on each page with its approved baseline and detects scripts that were added, removed or changed.

Script authorization (6.4.3)

Every script found gets a decision: approve it, or mark it unsafe, with a written reason, who decided and when. Approvals carry over to the next tests. PCI Monitor or a partner can pre-approve a known change, so it is approved automatically for the clients that choose to use pre-approved changes; each client can still decide for itself.

Inventory and review

A list of every script with a Low, Medium or High risk rating. Review each one: mark it safe, mark it unsafe, or keep it as another accepted version. Other security findings, such as Content Security Policy, can be reviewed and approved too, and the approval carries over.

Compliance tests and Health Checks

Compliance tests run daily, weekly or monthly and produce a compliance report. Health Checks run the script and tamper checks on their own schedule and raise alerts when something drifts, without a report. You can also run a test by hand at any time.

Integrity and tamper detection

Fingerprints each script's content to spot a changed file, checks Subresource Integrity (SRI) attributes and Content Security Policy settings, and flags scripts that appear while a page runs.

Page security checks

Looks beyond scripts: security headers, forms and frames, third-party network activity, certificates, the expiry of the domains scripts come from, and tag managers.

Real-browser testing

Every test runs in a real headless browser, so scripts that load only when a page runs are seen. You can watch a test live. Optional checks send a test card number to the payment form to see who receives it, and revisit the page as different visitors.

Reports and evidence

A compliance report is generated from each Compliance test and held for review until its scripts have been checked. An evidence API lets your compliance platform collect the results.

Fix tracking and trends

Raise a remediation ticket in Jira from a finding and PCI Monitor follows the ticket's status. KPI and monthly trend charts show how your results change over time.

Teams, partners and audit trail

Admin and read-only roles, sign-in with a verification code, and an audit log of changes. Partners manage clients from one place.

Notes, support and languages

Keep internal notes about the companies you manage, send support tickets from inside the app, and use the interface in English or Spanish.

What each test checks

  • Script inventory Every script on each page, local, external (third-party) or inline, by address or fingerprint.
  • Changes Scripts added, removed or changed compared with the approved baseline of the page.
  • Integrity Content fingerprints, Subresource Integrity (SRI) attributes, and Content Security Policy rules and reports.
  • Page security Security headers, forms and frames, third-party network activity, certificates, and domain expiry.
  • Script behaviour What each script can do on the page, and what the tag managers load.
  • Recorded journeys Each step of a recorded authentication and checkout flow, including pages that only appear mid-flow.
  • Optional active checks A test card number sent to the payment form, and the page compared across different visitors.

Not only for payment pages

Any page you choose

Login, account, sign-up or checkout: add the addresses you care about. The script inventory, change detection, security headers, Content Security Policy and SRI checks work on any page. The card-field test applies to payment forms.

Supply-chain risk

Notices when a tag manager, analytics or chat script is added or changed, and when a domain that scripts load from is close to expiring. PCI Monitor is a detection tool: it tells you what changed so you can act on it.

One list of third parties

A plain list of the tags and third-party scripts on each page and what each can do, so security and marketing work from the same list.

Ready to see what runs on your pages?

Add a monitor, record your authentication and checkout flow if you need one, and run your first test.

PCI Monitor helps you meet requirements 11.6.1 and 6.4.3. PCI DSS compliance depends on your whole program and is confirmed by your assessor.