Client-Side Security and PCI DSS Glossary

This glossary gives short, plain definitions of the terms used across the Security Library: the attacks (skimming, Magecart, formjacking), the browser controls (CSP, SRI, nonce, security headers), the practices (baseline, tamper detection, inventory) and the PCI DSS vocabulary (payment page, SAQ, QSA, ASV, TPSP). Definitions are simplified for orientation; the standards themselves are the authority.

Attacks and threats

Skimming: Stealing payment card data as it is entered or read. A physical skimmer sits on a card reader; a web skimmer is malicious script on a web page. See what is web skimming.
Web skimming / e-skimming: Theft of card data from a web page by injected JavaScript that copies what the customer types. "E-skimming" is the term the PCI SSC uses.
Magecart: An umbrella name used by researchers for many criminal groups and campaigns that inject card-stealing code into online shops and payment pages. It is not one program or one group.
Formjacking: Taking over a web form, often a payment form, to capture what is entered in it.
Supply chain attack: An attack that reaches many victims by compromising something they all depend on, such as a script, library or service provider. See third-party JavaScript risk.
Cross-site scripting (XSS): A flaw that lets an attacker make a victim's browser run the attacker's script as part of a legitimate page. See XSS and DOM tampering.
DOM (Document Object Model): The live structure of a web page in the browser, which scripts can read and change.
Exfiltration: Sending stolen data out to an attacker, for example through a hidden request from the page.

Web and browser terms

Script: A piece of JavaScript that runs in the browser as part of a page.
Inline script: A script written directly in the page's HTML rather than loaded from a separate file.
Third-party script: A script served by an organization other than the site's owner, such as analytics, advertising or chat widgets.
Tag manager: A service that loads other scripts ("tags") onto a site according to settings in a web console, without a code release. See tag manager risk.
Iframe: An element that embeds another web page inside a page. Payment providers often supply their payment form as an iframe.
Redirect: Sending the customer's browser from your page to another address, for example to a payment provider's hosted page.
Direct post: A payment design in which the merchant's own page builds the form and the browser sends card data straight to the payment provider.
CDN (content delivery network): A network of servers that delivers a site's files from locations close to visitors.
WAF (web application firewall): A control that filters requests to a web application to block common attacks.
CORS (cross-origin resource sharing): The browser mechanism by which a server says which other origins may read its responses. Needed for Subresource Integrity on cross-origin files.

Controls and practices

HTTP security header: A response header that switches on a browser protection, such as Content-Security-Policy or Strict-Transport-Security. See HTTP security headers.
CSP (Content Security Policy): A header that tells the browser which sources of scripts, frames, images and connections a page may use. See Content Security Policy for payment pages.
Nonce: A random, single-use value placed in a CSP header and on legitimate script tags so the browser runs only scripts that carry it.
Hash (in a CSP or SRI): A fingerprint of a file's exact content; the browser runs the file only if its fingerprint matches the one listed.
strict-dynamic: A CSP keyword that lets a script trusted by nonce or hash load further scripts that inherit its trust.
SRI (Subresource Integrity): An attribute that holds the expected hash of an external script or stylesheet so the browser can refuse a changed file. See Subresource Integrity explained.
HSTS (HTTP Strict Transport Security): A header that tells the browser to use only HTTPS for a site.
Script inventory: A list of every script on a page with its source, purpose, owner and approval. See how to build a payment page script inventory.
Baseline: The reviewed and approved known-good state of a page (its scripts, content and headers) against which later changes are compared.
Change detection / tamper detection: Comparing what a page delivers now with its baseline and alerting people to differences. See how to detect client-side tampering.
Synthetic monitoring: Using an automated browser to visit pages on a schedule and record what it receives.
Report-only mode: A way of sending a CSP so the browser reports violations without blocking anything, used to test a policy.

PCI DSS vocabulary

PCI DSS (Payment Card Industry Data Security Standard): The security standard for organizations that store, process or transmit payment card data.
PCI SSC (PCI Security Standards Council): The body that publishes PCI DSS and related documents. It does not itself enforce compliance.
Payment page: A web page where payment card data is entered, or that includes an embedded payment form. The PCI SSC's guidance discusses what counts; confirm with your assessor.
Requirement 6.4.3: The requirement to authorize, assure the integrity of and inventory payment page scripts. See PCI DSS 6.4.3 explained.
Requirement 11.6.1: The requirement for a change- and tamper-detection mechanism for payment page content and HTTP headers. See PCI DSS 11.6.1 explained.
Future-dated requirement: A requirement published in PCI DSS v4.0 that was treated as a best practice until its mandatory date, 31 March 2025.
Targeted risk analysis (TRA, 12.3.1): A documented analysis, defined in requirement 12.3.1, used to set the frequency of certain activities, such as how often the 11.6.1 mechanism runs.
Cardholder data (CHD) and CDE: Cardholder data is the card number and related details; the cardholder data environment (CDE) is the systems that store, process or transmit it or could affect its security.
SAQ (Self-Assessment Questionnaire): A questionnaire eligible merchants complete to validate compliance; SAQ A, SAQ A-EP and SAQ D apply to different ways of accepting payments. See the SAQ article.
ROC (Report on Compliance) and AOC: The report an assessor writes after a full assessment, and the Attestation of Compliance that summarizes the result.
QSA (Qualified Security Assessor): A company or person qualified by the PCI SSC to assess compliance with PCI DSS.
ISA (Internal Security Assessor): An employee of an organization who has been qualified by the PCI SSC to carry out internal assessments.
ASV (Approved Scanning Vendor): A company approved by the PCI SSC to perform the external vulnerability scans that PCI DSS requires.
TPSP (third-party service provider): A business that provides services to an entity that store, process or transmit account data or could affect its security, for example a payment provider or a hosting company. Managed under requirement 12.8.
Acquirer / compliance-accepting entity: The bank or payment brand that takes your PCI DSS validation and sets reporting obligations; the party to ask what applies to you.

Key takeaways

Skimming, Magecart, e-skimming and formjacking all describe card theft by malicious script in the browser.
CSP, SRI, nonces and security headers are browser controls; baselines, inventories and tamper detection are practices around them.
Requirements 6.4.3 (manage scripts) and 11.6.1 (detect change) are the PCI DSS requirements aimed at payment page scripts.
SAQ, ROC, QSA, ASV and TPSP are the roles and documents of PCI DSS validation; your acquirer decides which apply to you.

Frequently asked questions

What is the difference between a CSP nonce and a hash?

A nonce is a random value that changes with every response and is attached to approved script tags. A hash is a fingerprint of a specific script's content. Either lets the browser recognize approved scripts; nonces suit dynamic pages and hashes suit static scripts.

What is the difference between a QSA and an ASV?

A QSA assesses an organization's compliance with PCI DSS requirements. An ASV runs the external vulnerability scans that PCI DSS requires. Both are qualified or approved by the PCI SSC for their roles.

What does "payment page" mean in PCI DSS 6.4.3 and 11.6.1?

Broadly, a page where card data is entered or one that includes an embedded payment form. The PCI SSC's guidance discusses the boundaries, and your acquirer or assessor decides which of your pages count.

References

Last reviewed: October 17, 2026

Glossary: client-side security and PCI DSS terms