Does PCI DSS require script controls on payment pages?

Current PCI DSS requirements address managing and monitoring the scripts loaded on payment pages, including authorisation, integrity assurance and an inventory with justification. Confirm the specifics with your acquirer or assessor for your merchant level.

Will a web application firewall stop a skimmer?

Not reliably. Skimmers usually arrive through a legitimate script channel, so client-side controls — CSP, script inventory, change monitoring — are what detect them.

Website Securityintermediateguide

E-commerce Website Security

Online stores face a specific threat set: payment-page skimmers, third-party script risk, and account abuse. What to monitor and why.

Cyber Security Space editorial desk · Published 18 Jul 2026 · Updated 25 Aug 2026 · 2 min read · Reviewed 25 Aug 2026

Short answer

The defining risk for an online store is client-side payment skimming: a small script added to the checkout page copies card and address data as it is typed. Third-party scripts are the usual delivery route, which is why script inventory, a checkout Content-Security-Policy and change monitoring matter more here than on a brochure site.

Key takeaways

Skimmers are quiet by design — the order still completes, so revenue metrics reveal nothing.
Every script on a checkout page is part of your payment security boundary.
A checkout-specific CSP with an allowlist and reporting is the strongest single control.
Account takeover and refund abuse are business-logic problems, not infrastructure ones.

What threatens an online store specifically?

Threat	Risk scenario	Detection
Payment page skimming	An injected script exfiltrates card data from the checkout form	Script inventory diffing, CSP violation reports, checkout change monitoring
Third-party script compromise	A tag manager or widget provider is breached and serves malicious code	Network initiator review, Subresource Integrity where supported
Account takeover	Credential stuffing against customer accounts, then stored-card abuse	Failed login rate monitoring, impossible-travel checks, MFA
Coupon and refund abuse	Business logic exploited at scale rather than a technical flaw	Anomaly review of discount and refund rates
SEO spam injection	Spam pages injected into a store that has strong domain authority	Indexed page counts and crawler-view diffing

What should you implement first?

STEP 01
Inventory checkout scripts
List every script the payment page loads, its owner and its business justification. Remove the rest.
STEP 02
Apply a checkout CSP
Start in report-only mode with an allowlist, review reports, then enforce.
STEP 03
Monitor the checkout page for change
Alert on any change to the rendered payment page outside a deploy.
STEP 04
Protect customer accounts
Rate limiting, breached-password checks and optional MFA.
STEP 05
Reduce card data exposure
Use hosted fields or an iframe from your payment provider so raw card data never touches your DOM.

Why is monitoring more important than scanning here?

A skimmer is often served conditionally, only to real customer sessions, and never to a scanner. Change detection on the rendered checkout page and CSP violation reports catch that behaviour because they observe what customers actually receive, rather than what a scanner is served.

Frequently asked questions

Does PCI DSS require script controls on payment pages?: Current PCI DSS requirements address managing and monitoring the scripts loaded on payment pages, including authorisation, integrity assurance and an inventory with justification. Confirm the specifics with your acquirer or assessor for your merchant level.
Will a web application firewall stop a skimmer?: Not reliably. Skimmers usually arrive through a legitimate script channel, so client-side controls — CSP, script inventory, change monitoring — are what detect them.

Sources

PCI DSS documentation library — PCI Security Standards CouncilSupports: Payment page script management requirements.
Content Security Policy — MDN Web DocsSupports: CSP allowlisting and reporting for checkout pages.