On 31 March 2025, PCI DSS 4.0 became the only active version of the standard. One of the most significant new requirements is 11.6.1, which mandates automated script monitoring for payment and checkout pages. If your website directly accepts cardholder data, this requirement applies to you.
What does Requirement 11.6.1 say?
The requirement states that merchants must have a mechanism in place to detect unauthorized modifications to HTTP headers and scripts on payment pages. Detection must happen at minimum once every seven days. The goal is to catch attacks like Magecart, where threat actors inject skimming scripts into checkout pages to steal card numbers in real time.
In plain terms: you need to know what JavaScript is running on your payment page at all times, and you need to be alerted within seven days if that JavaScript changes without your knowledge.
Who is affected?
Any merchant that hosts or controls a payment page where cardholders enter data is in scope. This includes:
- E-commerce sites with their own checkout form
- Sites that embed a payment iframe on a page they control
- Merchants who use a JavaScript-based payment form from a provider
If your checkout redirects entirely to a third-party hosted payment page (for example, a full redirect to Stripe or PayPal), your side of that flow is generally out of scope for 11.6.1. Confirm your exact scope with your Qualified Security Assessor (QSA).
What does compliance actually look like?
To satisfy Requirement 11.6.1 you need a system that:
- Inventories all scripts on the payment page - both inline scripts and external script files
- Fingerprints each script so you can detect content changes
- Runs this check at least weekly
- Alerts you when a new script is added or an existing script changes
- Retains evidence of monitoring for audit purposes
Simply reviewing the page manually once a week does not satisfy the requirement. The control must be automated and the evidence must be timestamped.
Why was this requirement added?
Magecart attacks have been a persistent threat since at least 2015. Attackers compromise a CDN, a third-party analytics provider, or the merchant's own server, and inject a small JavaScript skimmer into the checkout page. The skimmer silently captures form field values as customers type and sends them to an attacker-controlled server. Victims typically do not notice anything wrong.
Notable incidents affected British Airways (500,000 cards), Ticketmaster, and hundreds of smaller e-commerce sites. The requirement was designed specifically to close this attack surface.
How Shieldome automates 11.6.1 compliance
Shieldome's PCI Monitoring feature handles the full 11.6.1 workflow. Add your checkout URL, and Shieldome immediately runs a baseline scan that fingerprints every script with SHA-256. From that point, weekly automated scans compare the live page against the baseline. If any script is added, removed, or changed, you receive an email alert within 24 hours.
Your scan history is timestamped and retained, giving you the audit trail your QSA will ask for.
Plans start at $29 per month for one checkout URL. Start with a free trial and have your first baseline set in under two minutes.