Dragon Checkout Guard

Checkout Guard now emails you after a check that finds a new, changed or removed script or a response header change on your payment pages.

• One email per check (the weekly scan, Scan now or WP-CLI), listing what changed since the previous check: new scripts with their page, changed scripts with the reason (for example, the file differs from the version you authorised on a given date), scripts that the last two checks did not see on a page they read in full, and header changes per page. No email when nothing changed. The first check lists the scripts recorded so far for you to review and authorise.
• On by default, sent to the site administration email address. Add your own recipients (up to 20) under Settings, Email alerts.
• Use Send test alert on the Settings tab to check that your site can deliver the email. Alerts use your site's own mail setup, so if WordPress email does not arrive, set up an SMTP plugin or ask your host.
• If an alert cannot be delivered, the plugin's screen says so, with the reason WordPress gave.
• The 11.6.1 check record (CSV, printable record and WP-CLI export) has a new last column saying whether each check's alert was sent.
• The add-on pointer (plugin-list link, footer line and notice) has been removed.

Every admin action now checks its own security token and your permission before reading the form. Payment-page matching and evidence are unchanged.

• Custom payment-page paths containing < or > are refused with a notice, as before, and nothing after them is lost.
• Percent-encoded and non-English paths keep working exactly as before.
• A list field sent in the wrong shape no longer saves the word "Array" as a path.
• Uninstall deletes data only when the opt-in is clearly on (1, true, yes or on), not for a value set to "false" or "no".

Scans now read Checkout on a standard WooCommerce store, and the check record reports exactly what was checked.

What's new in 1.0.8

• Scans read the Checkout page with a one-item cart held in memory for that scan only. Nothing is saved: no session, cookie, order or stock reservation. Choose the product with the dragoncheckoutguard_scan_cart_product filter.
• The 11.6.1 check record lists each page as read, skipped, needing a signed-in customer, redirected or not read, with the number of script hashes verified. A run that could not read every page is marked Incomplete, never No change.
• Header changes count in the check outcome, and a security header that appears after the baseline is flagged as added.
• A page answered with the login form (Add Payment Method, or Checkout on an account-only store) is recorded as needing a signed-in customer, and nothing from the login page is inventoried.
• Approving a script approves the content you were shown; if it changed since the page loaded, you are asked to look again.
• Tamper reasons explain in plain language that the contents differ from the version you authorised.
• After updating: stock stores see Checkout read for the first time, so expect new scripts and header rows to review once. Header rows the login form produced on Add Payment Method are removed.

Security hardening: the script inventory now matches what browsers actually load.

What's new in 1.0.7

• Security: script addresses are read the way browsers read them, so a disguised address can no longer be filed under an approved script.
• Security: on PHP 8.4 and later, pages are read as a browser reads them, so scripts hidden with markup tricks are recorded. Older PHP versions use a fallback that records extra entries rather than miss any.
• Inline script checks now notice a changed address or template inside the script.
• Recognised-provider suggestions need a script WordPress itself registered, from a real plugin folder on your own site.
• Response headers are read from what your server actually sends.
• After updating: approved inline scripts that name an address will show one change to review, and a few scripts may appear once as new rows. Headers your server adds may show once as added.

Translation-ready throughout.

What's new in 1.0.6

• Every screen, email and alert is now translatable, so community translations from translate.wordpress.org cover the whole plugin. Counts use proper plural forms, and numbers and dates follow your site's language.
• The inventory CSV now uses raw codes in every coded column, so it reads the same in any language; the printable report keeps readable labels.
• Settings show their units in the field labels.

Dragon Checkout Guard is now on WordPress.org, with a clearer listing title and tags.

Added

• An occasional request for a WordPress.org review once a few scans have run. It appears only on the plugin's own Tools screen. "No thanks" hides it for good and "Maybe later" snoozes it for a month.

Changed

• The WordPress.org listing title and tags, so merchants searching for PCI DSS payment page monitoring can find the plugin.

No changes to scanning, evidence or exports.

WordPress core scripts are now recognised on sites that serve wp-includes or wp-admin from a non-default location.

• Core scripts stay labelled. Scripts that WordPress itself loads are found through WordPress's own includes_url() and admin_url() instead of assumed folder names, so they keep showing as "WordPress Core" in the inventory and report, whatever your site's layout. Nothing changes on a standard install.

Scripts written as type="text/javascript; charset=utf-8" are now inventoried. Earlier versions skipped any script whose type carried a parameter, so run a scan after updating.

• Non-standard layouts. A renamed content directory, or WordPress in its own directory, no longer leaves your own scripts filed under "Site" and unhashed.
• Third-party downloads say less. The request that hashes a third-party script now names the plugin in its user agent instead of sending your site's URL.
• Collector floods clear themselves. If junk reports fill the browser collector's table, the daily maintenance clears unconfirmed rows within a day, instead of the collector staying paused for a month.
• Failed writes are reported. Authorising, revoking or ignoring a script is saved together with its audit line. Saving settings, queuing a scan, rotating the collector token and recording sightings all tell you when the database refused the write.
• Custom paths keep their encoding, so a payment page such as /caisse-s%C3%A9curis%C3%A9e can be scanned. If you entered such a path before, enter it again on the Settings tab.
• Printed report. Dates and handles no longer break mid-word, triggers and the backlog sentence read in plain words, and a script that is no longer authorised prints none of its old authorisation record. The inventory CSV leaves the same cells blank and exports Review due as a date.
• Site Health also flags an authorised script that has changed since.
• Clearer screens. The History panel names events in plain words, the Review due date no longer shifts by a day west of UTC, and WP-CLI help reads as whole sentences.
• The printable report loads its stylesheet through WordPress, and the readme has a full External services section.

Dragon Checkout Guard 1.0.2 makes the printable "Payment page script integrity record" readable on paper.

• The script inventory in the printed report is now laid out in nine grouped columns. The old twenty-column table broke words and dates letter by letter on A4.
• Every value is still printed: type and party sit under the script, owner and purpose under the justification, the full hash and last check under the integrity method, and first and last seen together.
• Long script URLs and hashes wrap inside their cells, rows no longer split across pages, and the table header repeats on every page.

The CSV exports, the inventory screen and the weekly check are unchanged.

Dragon Checkout Guard 1.0.1 adds a pointer to the new Pro add-on. No feature changed.

• Added a link to Dragon Checkout Guard Pro: an "Upgrade to Pro" plugin action link, a one-line footer on the plugin's own screens, and one dismissible notice once the plugin has done some work for you. "Not now" hides the notice for 60 days, and all three disappear when Pro is active.
• Nothing in the free plugin is locked, limited or greyed out. The script inventory, authorisation record, weekly tamper check, header baselines, exports, SAQ A route guide, Site Health tests and WP-CLI all work exactly as before.

Dragon Checkout Guard builds a record of what runs on your WooCommerce payment pages, so you have evidence to support your own PCI DSS assessment.

What you get in 1.0.0

• Script inventory across checkout, order pay, add payment method and cart, built from server capture and, optionally, a real shopper's browser via the browser collector.
• Authorisation record for every script: owner, business purpose, justification and integrity method, with recognised-provider prefill for the common gateways, fraud tools and tag managers.
• Weekly tamper check that rehashes every script's content on a WP-Cron schedule, plus Scan now, and records a per-script reason whenever a script cannot be hashed.
• Header baseline per page, capturing the security-relevant response headers your payment pages send and flagging drift from what you accepted.
• Assessor exports: an inventory CSV, an 11.6.1 check-record CSV, and a printable "Payment page script integrity record".
• SAQ A assessment guide, a three-question self-check that maps how your site takes payment to the route PCI SSC FAQ 1588 sets out and the records that route asks for.
• Site Health tests for the weekly check, unauthorised or changed scripts, and outstanding header drift.
• WP-CLI for scanning, listing, authorising, exporting and pruning, so the whole workflow is scriptable.

It runs on your own server, with no account and no telemetry; its outbound requests are limited to re-fetching script URLs your checkout page already references, to keep their content hashes current.