How it works
From first scan to bank-ready evidence
Five steps take you from an unverified domain to a monitored checkout with a monthly, dated paper trail for PCI DSS requirements 6.4.3 and 11.6.1 — with nothing to install on your site.
Setup
Add & verify your site
You start by telling ScriptProof which domain to watch and proving that you control it. We support two verification methods: a DNS TXT record — you add a short token like scriptproof-verify=… to your DNS zone, and we check for it — or an HTML meta tag placed in the <head> of your homepage. DNS verification survives theme changes and replatforms; the meta tag is quicker if you can edit your storefront but not your DNS.
Ownership verification matters for two reasons. First, it keeps the platform honest: nobody can point ScriptProof at a site they do not control and harvest details about its scripts and headers. Second, it anchors your evidence — every scan result and every Evidence Pack is tied to a domain you demonstrably owned at the time, which is exactly the kind of provenance an assessor or acquirer wants to see.
- DNS TXT or meta-tag verification — pick whichever your setup makes easier
- Verification is re-checked periodically, so evidence stays anchored to a domain you control
- Then list your payment pages: checkout, payment method entry, and any page that can affect them
Baseline
First scan builds your baseline
Once verified, our crawler visits your payment pages from our servers — there is nothing to install on your site. A headless browser loads each page the way a real shopper’s browser would, so we see not just the HTML but every script the page actually pulls in: first-party bundles, payment SDKs like Stripe.js or the PayPal SDK, tag managers, and the scripts those scripts load in turn.
Every discovered script is fingerprinted with a SHA-256 hash of its content, alongside its URL, load method, and where it appeared. We also snapshot the security-relevant HTTP headers on each page — Content-Security-Policy, and the rest of the hardening set — because requirement 11.6.1 covers tampering with headers, not just page content. This first scan becomes your baseline: the known-good state that every future scan is compared against.
- Headless-browser crawl from our servers — no agent, no code change, zero page weight
- SHA-256 content fingerprint recorded for every script, including dynamically loaded ones
- HTTP security headers snapshotted per page, so header tampering is caught too
$ scriptproof scan https://yourstore.com/checkout
✓ domain ownership verified (DNS TXT)
✓ 14 scripts discovered · fingerprinting SHA-256…
✓ 12/14 match authorized inventory
⚠ 1 script changed since last scan: analytics.shopmetrics.js
✕ 1 unknown script: static.unknown-cdn.ru/p.js — flagged
→ critical alert sent · evidence log updated
Authorize
Review & authorize your inventory
PCI DSS 6.4.3 asks for more than a list: each script on a payment page needs written justification for why it is necessary, and a method to confirm it is authorized. ScriptProof turns that into a short review workflow. Your baseline scan produces the inventory; you walk through it once, mark each script as authorized, and record the reason — “Stripe.js processes card entry”, “GA4 tag for conversion tracking” — in a sentence or two.
That justification is stored with the script’s fingerprint, who authorized it, and when. Anything you do not recognize can be flagged for investigation instead. From then on, the inventory is a living document: new scripts arrive as “pending review” rather than silently joining the authorized set, so your written-justification record never drifts out of date.
- One-click authorize with a recorded justification, reviewer, and timestamp per script
- Wording aligned to 6.4.3 — inventory, justification, and confirmation of authorization
- Unknown scripts stay quarantined as pending until a human signs them off
New unauthorized script detected on /checkout — 2 min ago
14
Scripts tracked
12
Authorized
1
Open alerts
Monitor
Continuous change detection
After the baseline, ScriptProof re-scans your payment pages on a schedule — daily on Starter, every 6 hours on Pro and Agency — and compares each script’s SHA-256 fingerprint and each page’s headers against the authorized state. Requirement 11.6.1 asks for this detection at least weekly; a daily cadence gives you a comfortable margin and a much smaller window for a skimmer to operate unnoticed.
Not every change is an emergency, so alerts carry severity. A brand-new script or a content change to an authorized payment script is critical and triggers an immediate email with the before/after hashes and a one-click review link. Weakened security headers rate high. Routine, lower-risk changes are batched into a daily digest so your inbox reflects risk, not noise. On Pro and Agency, an optional snippet — under 6 KB, and it fails silently — adds runtime detection of scripts injected in the browser that a crawl alone might miss.
- Daily or 6-hourly scans — comfortably inside 11.6.1’s at-least-weekly expectation
- Severity-ranked alerts: instant email for critical changes, a daily digest for the rest
- Every change is logged with before/after fingerprints, building your audit trail automatically
🚨 Critical: new script on /checkout
alerts@scriptproof → you · just now
static.unknown-cdn.ru/p.jsfirst seen 14:02 UTC · not in your authorized inventory
Before
13 scripts
After
14 scripts (+1)
Prove it
Monthly Evidence Pack
Monitoring only helps at assessment time if you can prove it happened. Once a month, ScriptProof compiles everything into a dated PDF Evidence Pack: Section A is your current script inventory with fingerprints; Section B is the authorization record — each script’s written justification, who approved it, and when; Section C is the change log for the period, including how each change was resolved; Section D documents your scan cadence and coverage.
The pack is designed to sit behind your SAQ answers for 6.4.3 and 11.6.1 — when your acquirer or an assessor asks how you meet those requirements, you attach the PDFs instead of assembling screenshots. Packs accumulate month over month into a continuous history, and Agency plans can white-label them for client deliverables.
- Sections A–D: inventory, authorizations, change log, and scan-cadence attestation
- Generated monthly (plus on-demand on Pro and Agency) and archived for a running history
- Attach directly to your SAQ or hand to your acquirer when they ask for proof
Evidence Pack
Monthly · PDF · PCI DSS 6.4.3 / 11.6.1
A. Script inventory & authorizations
B. Change log with hashes
C. Security header history
D. Scan cadence & coverage
sha256: 8c1f…a2e9 · signed
Ready for your SAQ
Under the hood
Built like security software, because it is
The engineering decisions behind the scanner — the parts you would ask about in a vendor review.
A transparent crawler
Our scanner identifies itself with a clear user-agent and a published IP policy, so you can allowlist or verify it. Details on the bot page.
SSRF-guarded fetching
Every URL we fetch is validated against private, loopback, and link-local ranges before and after DNS resolution — the scanner cannot be pointed at internal infrastructure.
SHA-256 fingerprints
Script integrity is tracked by content hash, not by URL alone — so a script that keeps its address but changes its behavior is caught immediately.
TLS everywhere
Scans, the dashboard, alert delivery, and Evidence Pack downloads all run over TLS. Data is encrypted in transit end to end.
No card data, ever
ScriptProof handles URLs, script metadata, hashes, and headers — never cardholder data. Read the full policy on our security page.
Zero page weight
Scanning runs entirely on our servers, so your shoppers load nothing extra. The optional runtime snippet on Pro+ is under 6 KB and fails silently.
Requirement mapping
What PCI DSS asks — and what you get
A plain-English paraphrase of the v4.0.1 sub-requirements ScriptProof supports, mapped to the feature that answers each one.
| Requirement | What the requirement asks | What ScriptProof gives you |
|---|---|---|
| 6.4.3 | Maintain an inventory of all scripts loaded and executed on payment pages. | Every scan rebuilds a live inventory of first- and third-party scripts on your payment pages, each with a SHA-256 fingerprint, URL, and load context. |
| 6.4.3 | Record written justification for why each of those scripts is necessary. | The authorization workflow stores a written justification per script, along with who approved it and when — exportable as Section B of the Evidence Pack. |
| 6.4.3 | Implement a method to confirm each script is authorized and to assure its integrity. | Fingerprints are compared against your authorized baseline on every scan; unauthorized or modified scripts are flagged as pending and alerted, never silently accepted. |
| 11.6.1 | Detect and alert on unauthorized changes to payment-page content and the HTTP headers received by the browser, evaluated at least weekly. | Daily (or 6-hourly) scans diff page scripts and security headers against the baseline, send severity-ranked alerts, and log a dated change history that documents your cadence. |
FAQ
Common questions about the process
- How often do scans run?
- Daily on the Starter plan and every 6 hours on Pro and Agency. Both comfortably exceed the at-least-weekly cadence 11.6.1 expects, and every scan is logged so your Evidence Pack can document the actual frequency.
- Do I need to install anything?
- No. Verification is a DNS record or meta tag, and all scanning runs from our servers using a headless browser. Pro and Agency plans offer an optional runtime snippet — under 6 KB, fails silently — for catching scripts injected in the browser, but it is never required.
- What counts as a critical change?
- A new script appearing on a payment page, a content change to an authorized script (its SHA-256 no longer matches), or a weakened security header. Critical changes trigger an immediate email with before/after fingerprints; lower-severity changes go into the daily digest.
- Can my agency manage multiple stores?
- Yes. The Agency plan covers up to 20 sites from one dashboard, with per-client script inventories, white-label Evidence Packs carrying your logo, and CSV export for your own reporting.
See it work on your own checkout
Run a free scan in seconds, or start a 14-day trial and have your baseline, authorized inventory, and first Evidence Pack within the month.
ScriptProof is a monitoring and evidence tool. It is not a Qualified Security Assessor (QSA) service and does not certify PCI DSS compliance. Consult your acquirer or a QSA for validation requirements.