Online skimming attacks hide malicious code in the scripts that run on a checkout page. Customers see nothing wrong; card numbers leave with every purchase. PCI DSS v4.0 responds with two requirements that became mandatory on 2025-03-31.
What the requirements ask
- Requirement 6.4.3: keep an inventory of every script on your payment pages, confirm each one is authorized, and ensure its integrity.
- Requirement 11.6.1: detect unauthorized changes to payment pages and their security headers, and alert your team when they happen.
Where merchants struggle
Most checkout pages load scripts from analytics, chat, marketing and payment providers. Few teams know the full list, and fewer know when it changes.
How to start
- List every script on the pages where card data is entered.
- Remove what you don’t need and document why each remaining script is there.
- Put change detection in place and decide who responds to an alert.
Not sure where you stand? Book a free consult and we’ll tell you what an assessor will look for.
Does this apply to you? A free 30-minute consult maps the requirement to your systems and tells you what to do next.
Book a free consult