Payment-page script inventory, authorisation record, weekly tamper check and header baseline: PCI DSS 6.4.3 / 11.6.1 and SAQ A evidence. No account.
Features
Every `<script>` src and inline block seen on your payment pages, discovered from the rendered HTML and, optionally, from a real shopper's browser. Inline blocks printed by WordPress are identified by handle and position, so a change to one is recorded as drift on the same row rather than appearing as a new script every time.
Record a justification, owner, business purpose, provider and integrity method (Subresource Integrity, hash monitored by this plugin, vendor-managed, or not feasible with a justification) for every script that belongs on your payment pages.
A weekly WP-Cron scan, plus Scan now and WP-CLI. Every pending script is rehashed on each run, and a change that could not be written is reported as a failed scan rather than a clean one.
Captures the security-relevant response headers (Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, Referrer-Policy, Permissions-Policy, the Cross-Origin trio, X-Content-Type-Options, Cache-Control and the CSP reporting headers) your payment pages send, and flags drift from the accepted baseline.
A known-provider list fills in the provider, purpose and a suggested justification for the common gateways, and flags tag managers, analytics and chat widgets with a reviewer note.
A three-question self-check that maps how your site takes payment to the FAQ 1588 route your answers point at, and to the records that route asks for. Your answers appear in the printable report as "Assessment context".
Inventory CSV, 11.6.1 check-record CSV and a printable "Payment page script integrity record", plus the same data from WP-CLI.
Whether the weekly check has run, whether any script is unauthorised, and whether any header baseline is outstanding.
On by default, it reports scripts that only exist once a real shopper's page is running (for example one injected by a tag manager), as observations you confirm before they join the inventory.
Guides
Step-by-step guides from the team that builds it. All guides
Compliance
Since 31 March 2025 card-taking stores have to show which scripts run on their payment pages and that changes get noticed. What that means for WooCommerce and how to keep the record.
Checkout Guard now emails you after a check that finds a new, changed or removed script or a response header change on your payment pages. • One email per check (the weekly scan, Scan now or WP-CLI), listing what changed since the previous check: new scripts with their page, changed scripts with the reason (for example, the file differs from the version you authorised on a given date), scripts that the last two checks did not see on a page they read in full, and header changes per page. No email when nothing changed. The first check lists the scripts recorded so far for you to review and authorise. • On by default, sent to the site administration email address.
