Source Defense vs Proteside: block the scripts or verify the payment?
By Laís Peixoto
Growth Marketer, Proteside
Published
Source Defense keeps third-party scripts from reading card data on the payment page, blocking in real time, and lets acquirers push that protection through the SDK they already ship. Proteside inventories scripts too, then checks that the QR, account, bank-slip line or wallet address shown match what the seller issued, and blocks the swap before confirmation.
Side by side
- How it describes itself
- Client-side security for websites, described by the company as the creator of the category; Protect prevents, Detect monitors, Acquirer Protect distributes the protection through acquirers and payment providers.
- Headquarters
- Rosh Ha'ayin, Israel, and Stamford, Connecticut, USA. Founded in 2014.
- How it enters the site
- Two lines of code on the site, with third-party scripts treated as untrusted by default; the site says it is up and running in 24 hours and takes around two hours of management per month.
- What it checks on the payment page
- Third-party and fourth-party scripts, how those scripts behave on the page, and their access to data typed into the card form.
- PCI DSS
- Requirement 6.4.3 cited for Acquirer Protect and in the QSA partner resources, with compliance reporting. Principal Participating Organization of the PCI SSC, per the council's public list.
Source Defense Protect e Detect
- How it describes itself
- Cybersecurity layer for the moment of payment: integrity of what the buyer sees, copies and confirms.
- Headquarters
- São Paulo, Brazil. Operating since 2026.
- How it enters the site
- One line of code on the payment page, or an integration in the platform or payment provider template. No proxy, no DNS or CDN change.
- What it checks on the payment page
- Third-party scripts, card form, Pix QR code and key, boleto (Brazilian bank slip) line, crypto wallet address and the QR codes of eight instant payment rails, matched against what the merchant issued.
- PCI DSS
- Evidence for PCI DSS requirements 6.4.3 and 11.6.1, with an exportable report for the QSA.
Proteside
Criterion by criterion
Marks are based on each vendor's public documentation. Hover over or tap a mark to read the legend.
| Source Defense | Proteside | |
|---|---|---|
| What is checked on the payer's screen | ||
| Inventory and authorization of scripts on the payment pageThe basis of requirement 6.4.3: know what runs on the page and authorize each script. | Described in public documentation | Described in public documentation |
| Card details typed into the formStop a script from copying the number, expiry date and security code. | Described in public documentation | Described in public documentation |
| Pix QR code and copy-and-paste code (Brazil)Brazil's most common checkout scam: the QR code shown leads to another account. | Not found in public information | Described in public documentation |
| Boleto (Brazilian bank slip) payment lineA swapped line pays a different payee for the same amount. | Not found in public information | Described in public documentation |
| QR codes of instant payment rails worldwide (UPI, PayNow, DuitNow, PromptPay, QR Ph, FPS, CoDi, Transferencias 3.0)The same swap as Pix, across eight instant payment systems. | Not found in public information | Described in public documentation |
| Stablecoin and crypto wallet address, including when copiedA wallet address swapped on screen or in the clipboard is irreversible. | Not found in public information | Described in public documentation |
| Matches what is on screen against what the merchant issued and blocks the swap before confirmationThe check that defines payment integrity: payee and amount equal to what was issued. | Not found in public information | Described in public documentation |
| How it protects | ||
| Blocks unauthorized scripts in the buyer's browserDetecting after the fact does not bring the copied data back. | Described in public documentation | Described in public documentation |
| Watches real buyer sessionsTargeted scams do not show up in simulated visits. | Described in public documentation | Described in public documentation |
| Works without changing CDN, DNS or proxyDrops into any platform with one line of code. | Described in public documentation | Described in public documentation |
| PCI DSS compliance | ||
| Evidence for PCI DSS requirement 6.4.3Inventory, authorization and integrity of scripts. | Described in public documentation | Described in public documentation |
| Evidence for PCI DSS requirement 11.6.1Unauthorized changes to the page and its headers. | Not found in public information1 | Described in public documentation |
| Exportable report for the assessor (QSA)Evidence has to leave the dashboard and reach the assessment. | Described in public documentation | Described in public documentation |
- Described in public documentation
- Described with a limitation (optional, sampled, requires human action or only in one product tier)
- Not found in public information
- The vendor states it does not do this
Notes on the marks
- 1Evidence for PCI DSS requirement 11.6.1: The public product pages cite requirement 6.4.3 (for Acquirer Protect and in the QSA partner resources) and describe PCI DSS compliance reporting. Requirement 11.6.1, which covers unauthorized changes to the page and its headers, does not appear by name in the material checked in October 2026. The mark is therefore 'not stated publicly' rather than 'does not do it'.
Where Source Defense stands out
Distribution through acquirers and providers
Acquirer Protect brings the protection to an entire merchant portfolio through the SDK the acquirer, payment provider or platform already ships, with no store-by-store install.
Top-tier participation in the PCI SSC
Source Defense appears on the council's public list as a Principal Participating Organization, the highest level of participation.
Light operation once installed
The site describes Protect as taking around two hours of management per month, with policies that start untrusted by default and get tuned over time.
Declared scale
More than 1,000 brands and 1.2 billion page views a month protected, according to the company's own site, after ten years of engineering focused on the client side.
What Proteside verifies that Source Defense's material does not mention
An electronics store in Bengaluru shows a UPI QR for a laptop costing 84,000 rupees. The shopper scans it with a banking app and pays. A script injected into the page had swapped the QR for one pointing to a different UPI ID, same amount. No card data left the page; the money left for the wrong account, and the store finds out when the order never reconciles.
Source Defense answers the card problem: third-party scripts untrusted by default, kept from reading the form, with real-time blocking in Protect. For UPI, PromptPay, PayNow, Brazilian bank slips (boleto) and crypto wallets, the public product pages do not describe a check of what the shopper sees. Proteside records what your server issued (QR, account identifier, bank-slip line, wallet address, amount) and compares it with what is displayed and what is copied, in every session. On a mismatch, confirmation is blocked and the attempt is logged as an alert and as evidence.
Script inventory and card-form protection come in the same install, with the change history that requirements 6.4.3 and 11.6.1 call for and a report ready for the QSA. One line of code watches the scripts and verifies the payment.
How each one enters your operation
Source Defense
- Two lines of code on the site; the material says it is up and running in 24 hours.
- Third-party scripts treated as untrusted by default, with policies tuned over time by your team.
- Protect blocks in real time; Detect monitors and alerts only, with data available through an API, alerts and a console. Acquirers and providers distribute it through their existing SDK.
Proteside
- One line of code on the payment page, on any platform, or a single integration in the platform's or payment provider's template.
- Each charge is recorded server-side and verified in every session, with no sampling.
- Automatic blocking before confirmation; dashboard, API and alerts by email, Slack, Teams and webhook.
When to choose each one
Source Defense makes sense when
- You are an acquirer, payment provider or platform and want to push script protection to your whole merchant portfolio through the SDK you already ship.
- Cards are the only payment method and the priority is keeping third-party scripts away from the form with little monthly operation.
- Your security team wants to start with monitoring and alerts only (Detect), consuming the data through an API, before turning on blocking.
Proteside makes sense when
- Your checkout takes UPI, PromptPay, PayNow, DuitNow, FPS, Brazilian bank slips or crypto.
- You need the beneficiary swap blocked in the shopper's own session, before confirmation.
- You want evidence for requirements 6.4.3 and 11.6.1, headers included, from a single install and without changing your CDN.
Both together
A merchant whose acquirer distributes Source Defense through its SDK can keep that card-form protection and add Proteside to the payment page to verify instant payments, bank slips and wallet addresses. The two scripts are independent; Proteside does not touch another tool's policies.
Frequently asked questions
Does Source Defense cover UPI, PromptPay, PayNow, bank slips or payment QR codes?
Not stated in the public information checked in October 2026. The product pages describe third-party scripts, data typed into the card form and compliance reporting.
Can Source Defense and Proteside be used together?
Yes. They are two independent scripts on the payment page. Proteside verifies payment data and scripts without altering legitimate payments or another tool's policies.
What is the difference between Protect and Detect?
According to the Source Defense site, Protect blocks unauthorized script access to data in real time, while Detect monitors and alerts without blocking. Proteside blocks by default in every session and logs the attempt.
I am an acquirer or payment provider. Which one do I distribute to merchants?
Both describe distribution through a provider. Acquirer Protect uses the SDK the acquirer already ships and focuses on card data. Proteside goes in as a single integration in the platform's or provider's template and also verifies UPI, PromptPay, PayNow, bank slips and crypto.
Do Source Defense and Proteside meet PCI DSS requirement 11.6.1?
Proteside produces evidence for requirements 6.4.3 and 11.6.1, with header monitoring and a QSA report. Source Defense's public pages cite 6.4.3; 11.6.1 does not appear in the material checked.
See Proteside checking your checkout
Fourteen days free, one line of code, every payment method on your page.