Free tool
Do you know every script on your checkout?
Card-skimming code hides among the ordinary scripts on a store's pages. Enter your store's address and we'll list every script on the way to your checkout, who it belongs to, and how well your pages are protected, with the PCI DSS rules that apply.
An example of the result: a score out of 100, and a list of what to fix and what’s good.
Results
Every script we found
One row per company. “In the page’s code” means it’s loaded by code written into the page, not a script tag of its own.
| Who | What it’s for | Loaded from | Pages | Files |
|---|
Checked . A quick look from the outside, not a full audit: we read your home page, a product page and your basket.
Know when anything changes
We can keep a list of every script on your payment pages, watch for new or changed ones and alert you, under our ISO 27001 certified controls. It's part of our cybersecurity service.
Two rules for payment pages.
Since 31 March 2025, PCI DSS v4.0.1 has two requirements for every script that runs on a payment page, including the scripts other companies add.
6.4.3 Know every script
Every script on a payment page is authorised, has a written reason for being there, and is checked to be what it should be. In practice, a list like the one this tool starts for you.
11.6.1 Spot every change
Unauthorised changes to payment pages, their scripts and their security headers are detected and alerted, at least weekly or as often as your risk assessment sets.
Why skimmers get in
Most card skimming arrives through a script you already trust, such as an extension, a tag manager or a third-party widget, which is changed or added without anyone noticing.
What the checker looks for.
Every script, and whose it is
Each script file and each company's code written into your pages, from your home page, a product page and your basket.
Ones we don't recognise
Script sources that aren't on our list of known companies, for you to explain or remove.
Tag managers
Google Tag Manager and others, which let people add scripts to your pages without a developer.
Content Security Policy
Whether your pages tell browsers which scripts may run, and whether the policy would stop an unknown one.
Integrity checks
Whether code loaded from public CDNs is checked with Subresource Integrity.
Monitoring
Whether a script-monitoring service is already watching your pages.
What people ask us.
Does a clean result mean I'm PCI compliant?
No. This is a quick look from the outside. PCI DSS compliance is assessed by your QSA or through your self-assessment questionnaire, and covers far more than scripts. The checker helps with 6.4.3 and 11.6.1 by showing you where to start.
Why don't you check the checkout page itself?
The checkout needs something in the basket, and we only read pages as any visitor would. Skimming scripts are usually loaded on every page, so the pages leading to your checkout show most of them. A full review opens the checkout in a real browser.
Why aren't my tag manager's scripts listed?
A tag manager adds its scripts after the page has loaded, so they aren't in the page we read. That's exactly why tag managers on payment pages need care. A full review records them in a real browser.
I'm on Shopify or BigCommerce. Does this apply to me?
The platform runs and secures its own hosted checkout. The scripts you add through apps, pixels, theme code and script managers are still yours to list and manage.
We use a payment provider's iframe or hosted page. Does this apply?
Since the January 2025 SAQ A revision, you confirm your site isn't susceptible to script attacks instead of answering 6.4.3 and 11.6.1 directly. See our plain-English guide to PCI DSS 6.4.3 and 11.6.1.
Do you keep my results?
No. We read three of your pages, show you what we found, and keep nothing.