PaymentPageScriptAudit / report
PaymentPageScriptAudit report: https://demo-shop.example/checkout
Demo report on a fictional sample site.
33 / 100
5 of 8 checks need attention (2 high priority).
- ✓ Scripts on the payment page inventoried (medium): 4 external (1 first-party, 2 third-party, 1 payment provider) and 4 inline.
- ✗ Third-party scripts carry Subresource Integrity (high): 0/2 have integrity=.
- ✓ Scripts with integrity also set crossorigin (low): 0 integrity script(s) without crossorigin.
- ✗ Third-party scripts pinned to a version (medium): 1/2 pinned; floating: www.googletagmanager.com.
- ✓ Every script loads over HTTPS (high): 0 non-HTTPS script(s).
- ✗ Content-Security-Policy restricts script sources (high): No Content-Security-Policy header.
- ✗ Inline scripts allowed only by nonce or hash (medium): 4 inline script(s), 0 with a nonce; CSP does not allow unsafe-inline.
- ✗ CSP violation reporting configured (change and tamper detection) (medium): No CSP reporting.
Reads your page and the scripts it references (up to 13 requests). Scripts injected later by JavaScript or tag managers are not visible in the served HTML; list them from your tag manager. Informational evidence to support your assessment, not a QSA validation or a statement of compliance.