Dragon Checkout Guard Pro

Dragon Checkout Guard Pro 1.0.0 is here: a tamper-evident evidence ledger, alerts with a named owner, a review queue that links script changes to plugin updates, and a branded evidence pack for your assessor.

Dragon Checkout Guard (free) detects what runs on your payment pages. Pro turns those detections into the operational record an assessor asks for under PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1. It is evidence supporting your assessment; it does not certify anything.

What is in 1.0.0

• Evidence ledger - every check, new script, change, authorisation, alert delivery and review decision is written to an append-only ledger. Each row is hashed onto the one before it, so an edited or deleted row is detectable. Verify the chain from the Evidence tab or WP-CLI, and export it to CSV with the stored payload so the chain can be recomputed outside WordPress.
• Alerts with an owner and a delivery log - email, signed webhook and Slack. Name the person accountable for responding, choose immediate or daily digest delivery, and see every delivery and test alert recorded with its outcome. Webhooks are signed (HMAC over timestamp and body) so the receiver can verify them.
• Review queue - new scripts, changed scripts and header changes in one place, with Approve, Acknowledge and a required reviewer note. When a change lands within 24 hours of an update to the plugin or theme that owns the script, the queue says so and offers "Approve as vendor update".
• Monitoring cadence and risk analysis - run checks weekly, daily, twice daily or every six hours. A guided targeted risk analysis records why that cadence was chosen, who reviewed it and when it is due again. A 52-week coverage calendar shows every week with a completed check, and a missed check raises an alert.
• Provider confirmation tracker - for PCI SSC FAQ 1588 route 2: record when each payment provider's written confirmation was requested and received, its reference, contact and review date.
• Evidence pack - a printable record for 30, 90 or 365 days: scope, risk analysis, provider confirmations, coverage, the script inventory, the check record, review activity, alert deliveries, header baselines and the ledger integrity result. Add your own name and logo. Monthly or quarterly reminders, and an SAQ due date reminder.
• Site Health and WP-CLI - a Site Health test for the check cadence, and wp dragon-checkout-guard-pro verify, ledger and check.

Good to know

• Requires Dragon Checkout Guard 1.0.0 or later, WordPress 6.5+, PHP 8.0+.
• Everything stays on your server. The only outbound traffic is to the alert channels you configure and to dragoncore.ltd for licence and update checks.
• If your licence lapses, every feature keeps working on your activated sites. New versions, downloads and support stop until you renew.
• On hosts where PHP's dns_get_record is disabled, webhook destinations must be reachable over IPv4.