Dragon Checkout Guard
Payment-page script inventory, authorisation record, weekly tamper check and header baseline: PCI DSS 6.4.3 / 11.6.1 and SAQ A evidence. No account.
Features
What Dragon Checkout Guard does
Script inventory
Every `<script>` src and inline block seen on your payment pages, discovered from the rendered HTML and, optionally, from a real shopper's browser. Inline blocks printed by WordPress are identified by handle and position, so a change to one is recorded as drift on the same row rather than appearing as a new script every time.
Authorisation workflow
Record a justification, owner, business purpose, provider and integrity method (Subresource Integrity, hash monitored by this plugin, vendor-managed, or not feasible with a justification) for every script that belongs on your payment pages.
Weekly tamper check
A weekly WP-Cron scan, plus Scan now and WP-CLI. Every pending script is rehashed on each run, and a change that could not be written is reported as a failed scan rather than a clean one.
Response-header baseline
Captures the security-relevant response headers (Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, Referrer-Policy, Permissions-Policy, the Cross-Origin trio, X-Content-Type-Options, Cache-Control and the CSP reporting headers) your payment pages send, and flags drift from the accepted baseline.
Recognised payment providers
A known-provider list fills in the provider, purpose and a suggested justification for the common gateways, and flags tag managers, analytics and chat widgets with a reviewer note.
Assessment guide
A three-question self-check that maps how your site takes payment to the FAQ 1588 route your answers point at, and to the records that route asks for. Your answers appear in the printable report as "Assessment context".
Exports for an assessor
Inventory CSV, 11.6.1 check-record CSV and a printable "Payment page script integrity record", plus the same data from WP-CLI.
Site Health tests
Whether the weekly check has run, whether any script is unauthorised, and whether any header baseline is outstanding.
Optional browser collector
On by default, it reports scripts that only exist once a real shopper's page is running (for example one injected by a tag manager), as observations you confirm before they join the inventory.
Requirements
- · WordPress 6.5 or newer
- · PHP 8.0 or newer
- · WordPress 6.5+ · PHP 8.0+
Changelog
Dragon Checkout Guard builds a record of what runs on your WooCommerce payment pages, so you have evidence to support your own PCI DSS assessment. ## What you get in 1.0.0 - **Script inventory** across checkout, order pay, add payment method and cart, built from server capture and, optionally, a real shopper's browser via the browser collector. - **Authorisation record** for every script: owner, business purpose, justification and integrity method, with recognised-provider prefill for the common gateways, fraud tools and tag managers. - **Weekly tamper check** that rehashes every script's content on a WP-Cron schedule, plus Scan now, and records a per-script reason whenever a script cannot be hashed. - **Header baseline** per page, capturing the security-relevant response headers your payment pages send and flagging drift from what you accepted. - **Assessor exports**: an inventory CSV, an 11.6.1 check-record CSV, and a printable "Payment page script integrity record". - **SAQ A assessment guide**, a three-question self-check that maps how your site takes payment to the route PCI SSC FAQ 1588 sets out and the records that route asks for. - **Site Health tests** for the weekly check, unauthorised or changed scripts, and outstanding header drift. - **WP-CLI** for scanning, listing, authorising, exporting and pruning, so the whole workflow is scriptable. It runs on your own server, with no account and no telemetry; its outbound requests are limited to re-fetching script URLs your checkout page already references, to keep their content hashes current.