Card-skimming attacks (also called e-skimming or Magecart) work by slipping a malicious script onto your checkout, where it quietly copies your customers' card details as they type. The hard part for a store owner is easy to miss: you cannot watch what you cannot see. A typical WooCommerce checkout loads a dozen or more scripts from plugins, themes, and third parties, and nothing normally tells you when that list changes.<\/p>\n\n
CyberShield Checkout Script Monitor gives you that visibility. It scans your own store pages and shows you every script loading on them, so you can see what runs on your checkout and where you stand on PCI DSS Requirement 6.4.3. It is a readiness and visibility aid. It does not make you PCI compliant, it does not block anything, and it is not affiliated with or endorsed by the PCI Security Standards Council.<\/strong> The compliance decision stays yours.<\/p>\n\n What it does:<\/p>\n\n How the baseline works, and why it is safe:<\/p>\n\n CyberShield Checkout Script Monitor does not ship a list of \"trusted\" sources. That would mean deciding on your behalf which third parties are safe, which is exactly the risk you want to avoid (a trusted provider getting compromised is a real attack path). Instead, the baseline is the scripts already present on your own site on the day you set it. Report-Only then flags anything that later differs from that baseline. Honest note: the baseline is \"what is here now,\" not a clean bill of health, so review your inventory and remove anything unwanted before you set it.<\/p>\n\n Who it is for:<\/p>\n\n WooCommerce store owners who want to see what runs on their payment page and be told when it changes, and the developers and agencies who support them. The 6.4.3 readout maps directly to the script-inventory requirement (mandatory for SAQ A-EP and D) and gives SAQ A merchants the evidence to make the \"not susceptible to scripts\" self-attestation from what they can see, not from hope.<\/p>\n\n Privacy: the plugin makes no outbound connections except scanning your own site's pages when you click \"Scan my checkout.\" CSP reports are received and stored on your own WordPress site; the visitor IP address and referrer are dropped and never stored.<\/p>\n\n This plugin uses no external or third-party services. It sends no data anywhere.<\/p>\n\n The only HTTP requests it makes are to your own site's URLs (home, shop, cart, checkout) when you click \"Scan my checkout\", to read your own pages' HTML. Monitoring reports are posted by your visitors' browsers to a REST endpoint on your own site and stored in your own database.<\/p>\n\n The vendor domain names that appear in the plugin's source code (Google Tag Manager, Stripe, PayPal, Meta, cdnjs, unpkg, and similar) are a recognition list only: they are used to put a readable label on scripts already present on your own pages. The plugin never loads files from, embeds, or connects to any of those domains.<\/p>\n\n CyberShield Checkout Script Monitor is built by CyberShield Studio, a founder-led PCI compliance practice for e-commerce merchants. Its maker, Dennis Wu, holds the CISSP and PCIP certifications and has 30+ years in security. The plugin is open source (GPLv2), so you can read every line yourself.<\/p>\n\n\n No, and be wary of any plugin that says it does. CyberShield Checkout Script Monitor is a visibility and monitoring tool: it shows you every script on your checkout and alerts you when one changes, which is how you catch a skimmer early. It is Report-Only and never blocks. Deciding what belongs on your payment page, and removing what does not, stays your call.<\/p><\/dd>\n It is a focused one. Rather than a broad firewall or malware scanner, it does one job well: inventory the scripts on your checkout and payment pages and alert you to changes, mapped to PCI DSS Requirement 6.4.3. It complements a general security plugin; it does not replace one.<\/p><\/dd>\n No. It gives you visibility and a starting point for Requirement 6.4.3. Compliance is your responsibility and, depending on your setup, may involve your acquirer or a QSA.<\/p><\/dd>\n No. CyberShield Checkout Script Monitor only uses The scan reads scripts written into the page HTML. Scripts injected later by other scripts (for example by a tag manager) may not appear. A full external scan can catch those.<\/p><\/dd>\n To your own WordPress site's database. Nothing is sent to a third party. A future opt-in version may offer a hosted collector, disclosed separately.<\/p><\/dd>\n\n<\/dl>\n\n\n\n
Content-Security-Policy-Report-Only<\/code> header on the cart and checkout (your payment path, the pages Requirement 6.4.3 is about), built from a baseline of the scripts already on your own<\/strong> site. It never blocks anything. When a new or changed script appears, your browser reports it, so you can catch drift, the early signal of a skimmer, a rogue plugin update, or an unexpected third party.<\/li>\n<\/ul>\n\nExternal services<\/h3>\n\n
About the author<\/h3>\n\n
\n
\/wp-content\/plugins\/cybershield-checkout-script-monitor<\/code>, or install it from the Plugins screen.<\/li>\n\n
Does this stop card skimming or Magecart?<\/h3><\/dt>\n
Is this a WooCommerce security plugin?<\/h3><\/dt>\n
Does this make my store PCI compliant?<\/h3><\/dt>\n
Will turning on monitoring break my checkout?<\/h3><\/dt>\n
Content-Security-Policy-Report-Only<\/code>, which reports but never blocks. Your customers see and experience no change.<\/p><\/dd>\nWhy do some scripts not show up?<\/h3><\/dt>\n
Where do my alerts go?<\/h3><\/dt>\n
1.0.0<\/h4>\n\n
\n