PCI DSS 4.0 Monitoring

What is PCI DSS 4.0 Requirement 11.6.1?

PCI DSS 4.0 introduced Requirement 11.6.1, which became mandatory for all merchants on 31 March 2025. It requires that payment pages are monitored for unauthorized script changes at least once every seven days. The goal is to detect Magecart-style attacks, where attackers inject malicious JavaScript into checkout pages to silently steal card data.

Shieldome's PCI Monitoring feature automates the full 11.6.1 workflow. It fetches your payment page, inventories every script (inline and external), computes SHA-256 fingerprints, verifies Subresource Integrity attributes, and alerts you within 24 hours whenever an unauthorized script appears or an existing script changes.

How PCI Monitoring works

When you add a checkout URL, Shieldome runs a baseline scan:

1. The page is fetched and all <script> tags are collected.
2. For each external script, Shieldome downloads the file and computes its SHA-256 fingerprint.
3. For each inline script, Shieldome hashes the script body directly.
4. If an external script carries an integrity attribute, Shieldome verifies it matches the actual file content (SRI validation).
5. The full inventory is saved as your baseline. Every subsequent scan compares against it.

After the baseline is set, weekly scans run automatically. If any script is added, removed, or changed since the last scan, you receive an email alert with a full diff.

Plans and quotas

Adding a checkout URL

Open the PCI Monitoring tab in the dashboard. Click Add checkout URL, enter the full URL of your payment page (for example, https://example.com/checkout), and add an optional label. Shieldome immediately runs the baseline scan in the background.

Once the baseline is complete, the card shows:

• Status badge: Baseline set, OK, New scripts, Changed, or Error
• Total script count from the last scan
• Date and time of the last scan

To remove a URL, click the delete icon on the card. Historical scan results are retained for 90 days.

Script inventory and fingerprinting

Each script in the inventory has the following fields:

SRI verification

Subresource Integrity (SRI) is a browser security feature that lets you pin an external script to a specific hash. If the CDN is compromised and the script file changes, the browser refuses to execute it.

Shieldome checks every external script that carries an integrity attribute and verifies that the declared hash matches the actual content of the file at scan time. An SRI failure means the script file no longer matches what the page claims it should be, which is a strong indicator of tampering.

To generate an SRI hash for a script you host or load from a CDN, use the SRI Hash Generator or the openssl command:

cat script.js | openssl dgst -sha384 -binary | openssl base64 -A

Then add the result to your script tag:

<script src="https://cdn.example.com/payment.js"
        integrity="sha384-<your-hash>"
        crossorigin="anonymous"></script>

Alert emails

When a scan detects a change, Shieldome sends an alert to your account email. The alert includes:

• The checkout URL and scan timestamp
• A list of new scripts added since the baseline
• A list of scripts whose content changed (hash mismatch)
• A list of scripts that were removed
• Any SRI failures detected

Triggering a manual scan

Click the Scan now button on any checkout URL card to trigger an immediate scan outside the weekly schedule. Manual scans count the same as scheduled scans for baseline comparison purposes.

Scan history

Click View history on a checkout URL card to see a timeline of all past scans, their status, and script counts. Select any scan to see the full script inventory snapshot from that point in time.

Frequently asked questions

Does PCI Monitoring replace a full PCI DSS assessment?
No. Requirement 11.6.1 is one control within PCI DSS 4.0. Shieldome automates this specific control. A full PCI DSS assessment requires a Qualified Security Assessor (QSA) and covers many additional requirements.

Can I use this as evidence for my PCI audit?
Yes. Your scan history, script inventory, and alert logs are timestamped and can be exported as evidence that you performed the required weekly monitoring. Check with your QSA on the exact documentation format they require.

What if my payment page uses a third-party hosted payment form?
If your checkout page is hosted entirely by your payment provider (for example, a fully-hosted payment page you redirect to), Requirement 11.6.1 may not apply to your side. Consult your QSA to confirm your scope. If you embed a payment iframe on your own page, the requirement typically applies to the parent page.

What happens if Shieldome cannot reach my checkout page?
The scan is marked as Error and you receive an alert. Common causes include firewall rules blocking the scanner IP, bot-detection systems, or the page requiring authentication. Make sure your checkout page is reachable without a login session.

Does Shieldome store my payment page content?
Shieldome stores only the script inventory (URLs, hashes, SRI attributes) and the scan metadata. The full HTML of your page is never stored.