PCI DSS 4.0 and payment page scripts: what changes for your store
PCI DSS 4.0 made script control on payment pages an explicit requirement. For an online store, that turns “we trust our plugins” into two concrete jobs: know every script on the payment page, and notice when one changes.
The two requirements
Requirement 6.4.3 asks for an inventory of scripts that run on payment pages, with a reason for each, and a way to confirm they are authorised and unaltered. Requirement 11.6.1 asks for a mechanism that detects unauthorised changes to payment pages and alerts on them.
The full text is on the PCI Security Standards Council site. Your payment provider and acquirer decide exactly how it applies to you — a fully hosted payment page reduces what is in scope.
What it means on Magento and WooCommerce
Recent Magento 2.4 releases added a stricter Content Security Policy and Subresource Integrity support on checkout payment pages to help here. On WooCommerce, the scripts come from the theme, the gateway plugin and whatever marketing tags you load.
Either way, the practical first step is the same one we recommend for performance: keep third-party scripts off the checkout unless they are needed there. A short list is far easier to justify and to watch.
Watching for changes
Change detection means comparing what the payment page loads today with what it loaded yesterday: script sources, their content, and where the page sends data. Skimmers, described in Magecart skimming, are exactly the kind of change it is meant to catch.
A synthetic checkout that records network requests on every run gives you that history for free, alongside the question it already answers: can a customer still pay?
Check your own store now, free: the WooCommerce checkout checker or the Magento checkout test walks the checkout in a real browser and shows the step where it stops.
Common questions
What is PCI DSS requirement 6.4.3?
Every script on the payment page must be authorised, its integrity checked, and kept in an inventory with a reason for it.
What is PCI DSS requirement 11.6.1?
A mechanism must detect unauthorised changes to the payment page’s HTTP headers and content, checked at least weekly.
Do these apply if I use a hosted payment page?
It depends on your integration; ask your acquirer which SAQ applies. Pages that embed or redirect to payment forms are often in scope.