PaymentPageScriptAudit: the PCI DSS 4.0 script inventory for your checkout page
PaymentPageScriptAudit is a free, read-only check with 8 automated tests: Enter your checkout or payment page. We list every script it loads (first-party, third-party and payment provider), check Subresource Integrity, unpinned versions, HTTPS and your Content-Security-Policy with reporting, the evidence requirements 6.4.3 and 11.6.1 ask for since March 2025. The pack has the inventory as a CSV with a justification column and the exact integrity hashes to paste. Results are instant; copy-paste fixes and monitoring start at $4.99. It is also available to AI agents as the MCP tool audit_payment_
Enter your checkout or payment page. We list every script it loads (first-party, third-party and payment provider), check Subresource Integrity, unpinned versions, HTTPS and your Content-Security-Policy with reporting, the evidence requirements 6.4.3 and 11.6.1 ask for since March 2025. The pack has the inventory as a CSV with a justification column and the exact integrity hashes to paste.
Unlock the complete deliverable
Your free check above is complete. The fix pack adds a copy-paste fix for every item that needs attention. The first 3 are below, free.
Tailor unlock for:
Card, Apple Pay, Google Pay or Link via Stripe; refunds on request within 14 days.
✓ Read-only, live public data · Key and unlock right after payment · Card, Apple Pay, Google Pay or Link via Stripe · Refunds on request within 14 days
Preview what the unlock includes
- A copy-paste fix for every check that needs attention, written for your page
- Where each fix goes (page HTML, server headers or DNS) and how to confirm it
- Re-run the free check any time to verify
Already paid? Enter your key or email to unlock
Reads your page and the scripts it references (up to 13 requests). Scripts injected later by JavaScript or tag managers are not visible in the served HTML; list them from your tag manager. Informational evidence to support your assessment, not a QSA validation or a statement of compliance.
Plans
Copy-Paste Fix Pack
$4.99 one-time
- One-time $4.99: copy-paste fixes for every failing check on one domain
- Unlocked instantly with your key
Weekly Monitor (5 domains)
$9 / month ($0.30/day)
- Weekly read-only re-check of up to 5 domains. Billed monthly (or yearly at the annual price); cancel any time
- Change log on your watch dashboard and API, plus email alerts on changes
Agency 50-Domain Pro
$49 / month ($1.61/day)
- Daily checks for up to 50 client domains. Billed monthly (or yearly at the annual price); cancel any time
- Change log, CSV export and API access
More ways to buy
500 API / MCP Credits
$9.99 one-time
- 500 full (unredacted) REST or MCP calls across every product
- Credits never expire
Unlimited API / MCP Key
$29 / month
- Unlimited full REST and MCP calls across every product. Billed monthly (or yearly at the annual price); cancel any time
- For Make, Zapier, n8n and AI agents
Watch My Domain
$5 / month
- Weekly read-only re-check of one domain. Billed monthly (or yearly at the annual price); cancel any time
- Email when the result changes
White-Label Client Report
$9.99 one-time
- One downloadable client-ready HTML report with your agency name and domain in the header
- No branding from us
Agency White-Label Pass
$79 / month
- Unlimited white-label client reports for this tool. Billed monthly (or yearly at the annual price); cancel any time
API: 10 free calls per day without a key. Datasets contain public records only, at organization level.
Payments are processed securely by Stripe. Refunds are available by default within the first 14 days of paid service.