Digital skimming attacks (commonly known as Magecart) represent one of the most prolific threats to e-commerce and SaaS platforms worldwide. Rather than breaking into encrypted backend payment databases, attackers compromise third-party JavaScript libraries (such as chat widgets, analytics trackers, or tag managers) and inject code that silently exfiltrates credit card numbers directly from the consumer’s browser.
To shut down this attack vector, the PCI Security Standards Council introduced two mandatory requirements in PCI DSS v4.0.1: Requirement 6.4.3 (preventive script management) and Requirement 11.6.1 (detective tamper monitoring).
These requirements are no longer future-dated recommendations. Qualified Security Assessors (QSAs) are actively auditing production checkout pages against them today.
The Iframe Misconception: Merely loading your credit card form via an embedded iframe (such as Stripe Elements or Braintree Drop-in) does not exempt you. The hosting parent page falls under Requirements 6.4.3 and 11.6.1 because malicious JavaScript running on the parent page can steal keystrokes or inject fraudulent overlays.
Deep Dive: Requirement 6.4.3 (Script Inventory & Integrity)
Under Requirement 6.4.3, organizations must manage all scripts loaded on payment checkout pages through three mandatory controls:
- Method for Authorization: You must maintain a formal procedure confirming that every script executing on payment pages is authorized by your security or engineering team.
- Written Business Justification: Each script must have documented rationale explaining why it is required on the payment page. Marketing tags that have no purpose on a checkout form must be stripped.
- Integrity Assurance: You must deploy technical mechanisms to ensure that the code within each script has not been modified.
Technical Implementation of 6.4.3
The two most effective technical standards for meeting Requirement 6.4.3 are Subresource Integrity (SRI) and Content Security Policy (CSP):
Deep Dive: Requirement 11.6.1 (Tamper Detection & Alerting)
Requirement 11.6.1 mandates a detective control to alert your team whenever unauthorized changes occur to payment page headers or script contents:
- Frequency: Tamper checks must execute at least once every seven days, or continuously in real time.
- Detection Scope: The mechanism must evaluate HTTP headers (such as Content-Security-Policy) and script contents loaded in the browser.
- Automated Alerting: Any unauthorized change must immediately trigger an alert to your security operations team for triage.
QSA Audit Evidence: What You Must Provide
When your QSA arrives for field assessment, you must present:
- The Script Register: A dated inventory listing every script URL, script hash, owning vendor, business justification, and approval timestamp.
- CSP & SRI Configurations: Production web server headers demonstrating that unapproved script execution is blocked by the browser.
- Monitoring Logs: Seven-day historical logs showing that tamper detection scans executed and alerting functioned without failure.
Validate Your PCI DSS 4.0 Client-Side Controls
Eliminate Magecart exposure and pass your QSA review. Lorikeet Security evaluates your payment page script posture, CSP policies, and client-side integrity during our specialized PCI penetration tests.
