Skip to content

PCI DSS 6.4.3 and 11.6.1: what your payment page needs

Laís Peixoto

By Laís Peixoto

Growth Marketer, Proteside

Published · 2 min read

Requirement 6.4.3 demands an inventory, authorization and justification for every script on the payment page; 11.6.1 demands detecting unauthorized changes to that page and alerting. Both have been mandatory since March 31, 2025.

Since March 31, 2025, two PCI DSS requirements apply to anyone with card payment pages: 6.4.3 and 11.6.1. Both were created to fight card data theft directly in the buyer's browser.

What 6.4.3 requires

Every script loaded on the payment page must be under control:

  • Inventory of all scripts on the page.
  • Authorization of each script, with an owner.
  • Written justification of why each script is needed.
  • Integrity assurance, meaning a method to confirm the script has not been altered.

What 11.6.1 requires

The payment page needs a mechanism that detects unauthorized changes to the content and security headers the browser receives, and that raises an alert when it happens. Checks must run at least weekly or at the frequency defined by the company's risk analysis.

Who must comply

In general, any operation whose page takes part in capturing the card: own checkout, embedded forms or pages that load the payment field. The exact scope depends on the flow design and should be validated with your QSA or acquirer.

How to produce evidence without spreadsheets

Spreadsheets and screenshots are outdated the next day. The sustainable path is a continuous process that discovers scripts automatically, records approvals and justifications, monitors the live page and exports a report with history.

Proteside delivers this evidence as a by-product of protection: besides inventorying and monitoring, it blocks card copying, QR swaps and fake forms: the very attack the requirements aim to prevent.

Back to blog

Read next