Requirements 6.4.3 (authorize and inventory every script on payment pages) and 11.6.1 (detect changes to them) took effect on March 31, 2025, aimed at card-skimming attacks. In January 2025 the PCI Council removed them from SAQ A and added an eligibility check instead. What applies to your checkout, depending on how card data is captured, and how to meet it.
Card skimming on e-commerce sites works by getting a malicious script onto the checkout page, often through a compromised third-party script, where it copies card details as customers type. PCI DSS 4.0 added two requirements aimed directly at it, which became mandatory on March 31, 2025.
6.4.3: every script loaded and executed on payment pages in the consumer's browser is authorized, its integrity is assured, and there is an inventory with a written justification for each.
11.6.1: a change- and tamper-detection mechanism alerts on unauthorized changes to the security-relevant HTTP headers and contents of payment pages as the browser receives them, run at least weekly or as often as a targeted risk analysis sets.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Prefer the processor's hosted page or iframe. It is the single biggest reduction in scope and risk.
Keep payment pages minimal: no tag managers, chat widgets, A/B testing or analytics scripts on them.
Set a strict Content Security Policy on payment pages listing exactly the script sources allowed, and use Subresource Integrity for scripts you load from fixed URLs.
Serve those headers from your CDN (CloudFront response headers policies, for example) so they cannot be dropped by an application change.
Monitor the page as browsers see it, using a script-monitoring service or CSP violation reports collected and alerted on.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Black Friday 2026 Readiness on AWS: Load Testing, Quotas and the Things That Fall Over
Black Friday is November 27 and Cyber Monday November 30. Most peak-day outages are not raw capacity: they are a quota nobody raised, a database connection limit, a third-party API that throttles, or a cache that was never warm. A four-week plan, the AWS limits worth checking, and what to freeze.
Read
Cookies, Sessions, CORS and CSRF: What Each One Actually Protects
CORS is not a firewall, SameSite is not a complete CSRF defence, and a token in localStorage is not safer than a cookie, just exposed differently. What each browser mechanism does and does not do, and the cookie settings we would start with.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.