PCI DSS 4.0 · Req. 6.4.3 & 11.6.1

Prove your checkout headers haven't been tampered with

PCI DSS 4.0 requires e-commerce merchants to manage payment-page scripts and detect unauthorized changes to HTTP headers. Scan your checkout and get the Content-Security-Policy that shuts Magecart out.

What do 6.4.3 and 11.6.1 require?

6.4.3 — Script management

Every script on the payment page must be authorized, integrity-assured and inventoried. A strict CSP is the enforcement layer.

11.6.1 — Change & tamper detection

Detect unauthorized changes to security-impacting HTTP headers and script contents, at least weekly.

Evidence for your QSA

Our report maps each header to the requirement it supports, with a timestamped scan you can share.

Weekly header change alerts for your checkout (coming soon)

Join the waitlist for automated 11.6.1 monitoring.

Start here: Content-Security-Policy explained · CSP on Cloudflare