# PaymentPageScriptAudit: the PCI DSS 4.0 script inventory for your checkout page

**PaymentPageScriptAudit is a free, read-only check with 8 automated tests: Enter your checkout or payment page. We list every script it loads (first-party, third-party and payment provider), check Subresource Integrity, unpinned versions, HTTPS and your Content-Security-Policy with reporting, the evidence requirements 6.4.3 and 11.6.1 ask for since March 2025. The pack has the inventory as a CSV with a justification column and the exact integrity hashes to paste. Results are instant; copy-paste fixes and monitoring start at $4.99. It is also available to AI agents as the MCP tool audit_payment_**

Enter your checkout or payment page. We list every script it loads (first-party, third-party and payment provider), check Subresource Integrity, unpinned versions, HTTPS and your Content-Security-Policy with reporting, the evidence requirements 6.4.3 and 11.6.1 ask for since March 2025. The pack has the inventory as a CSV with a justification column and the exact integrity hashes to paste.

## Unlock the complete deliverable

Your free check above is complete. The fix pack adds a copy-paste fix for every item that needs attention. The first 3 are below, free.

Tailor unlock for: My businessClient / agency auditSales / lead list

Add Pro monitoring instead: Weekly Monitor (5 domains), $9/month, re-checks on a schedule and emails changes

Unlock everything — $4.99 one-time →

Card, Apple Pay, Google Pay or Link via Stripe; refunds on request within 14 days.

✓ Read-only, live public data · Key and unlock right after payment · Card, Apple Pay, Google Pay or Link via Stripe · Refunds on request within 14 days

Preview what the unlock includes
- A copy-paste fix for every check that needs attention, written for your page
- Where each fix goes (page HTML, server headers or DNS) and how to confirm it
- Re-run the free check any time to verify

Already paid? Enter your key or email to unlock

Reads your page and the scripts it references (up to 13 requests). Scripts injected later by JavaScript or tag managers are not visible in the served HTML; list them from your tag manager. Informational evidence to support your assessment, not a QSA validation or a statement of compliance.

## Plans

Monthly
Yearly

### Copy-Paste Fix Pack

$4.99 one-time

- One-time $4.99: copy-paste fixes for every failing check on one domain
- Unlocked instantly with your key

Get Copy-Paste Fix Pack — $4.99 →

### Weekly Monitor (5 domains)

$9 / month ($0.30/day)

- Weekly read-only re-check of up to 5 domains. Billed monthly (or yearly at the annual price); cancel any time
- Change log on your watch dashboard and API, plus email alerts on changes

Start Weekly Monitor (5 domains) →

### Agency 50-Domain Pro

$49 / month ($1.61/day)

- Daily checks for up to 50 client domains. Billed monthly (or yearly at the annual price); cancel any time
- Change log, CSV export and API access

Start Agency 50-Domain Pro →

## More ways to buy

### 500 API / MCP Credits

$9.99 one-time

- 500 full (unredacted) REST or MCP calls across every product
- Credits never expire

Buy now

### Unlimited API / MCP Key

$29 / month

- Unlimited full REST and MCP calls across every product. Billed monthly (or yearly at the annual price); cancel any time
- For Make, Zapier, n8n and AI agents

Subscribe

### Watch My Domain

$5 / month

- Weekly read-only re-check of one domain. Billed monthly (or yearly at the annual price); cancel any time
- Email when the result changes

Subscribe

### White-Label Client Report

$9.99 one-time

- One downloadable client-ready HTML report with your agency name and domain in the header
- No branding from us

Buy now

### Agency White-Label Pass

$79 / month

- Unlimited white-label client reports for this tool. Billed monthly (or yearly at the annual price); cancel any time

Subscribe

API: 10 free calls per day without a key. Datasets contain public records only, at organization level.

Payments are processed securely by Stripe. Refunds are available by default within the first 14 days of paid service.

## Copy-paste fix pack

## Often used together

- [PrivacyHeaderPulse](/privacyheaderpulse)
- [StripeCheckoutFrictionAudit](/checkoutfrictionaudit)
- [U.S. DOT General Transit Feed Specification Weblinks Pulse](/v/usgeneraltransitfeedspecpulse)
- [CtHazardousWasteManifestPulse](/v/cthazardouswastemanifestpulse)
- [New York Lead Testing in School Drinking Water Sampling and Results Pulse](/v/nyleadtestingschoold4n6npulse)
- [LocalSchemaPulse](/localschemapulse)