# paymentpagescriptaudit report: https://demo-shop.example/checkout

> Demo report on a fictional sample site.

**Score:** 33/100 · Scanned 2026-10-27T23:14:04.956Z

5 of 8 checks need attention (2 high priority).

- [x] **Scripts on the payment page inventoried** (medium): 4 external (1 first-party, 2 third-party, 1 payment provider) and 4 inline.
- [ ] **Third-party scripts carry Subresource Integrity** (high): 0/2 have integrity=.
- [x] **Scripts with integrity also set crossorigin** (low): 0 integrity script(s) without crossorigin.
- [ ] **Third-party scripts pinned to a version** (medium): 1/2 pinned; floating: www.googletagmanager.com.
- [x] **Every script loads over HTTPS** (high): 0 non-HTTPS script(s).
- [ ] **Content-Security-Policy restricts script sources** (high): No Content-Security-Policy header.
- [ ] **Inline scripts allowed only by nonce or hash** (medium): 4 inline script(s), 0 with a nonce; CSP does not allow unsafe-inline.
- [ ] **CSP violation reporting configured (change and tamper detection)** (medium): No CSP reporting.

---
Reads your page and the scripts it references (up to 13 requests). Scripts injected later by JavaScript or tag managers are not visible in the served HTML; list them from your tag manager. Informational evidence to support your assessment, not a QSA validation or a statement of compliance.