The Scripts on Your Checkout Page Are Now a PCI DSS Problem

PCI DSS v4.0.1 introduces explicit requirements for merchants to inventory, authorize, and monitor all scripts running on payment checkout pages — directly targeting the threat of web skimming (Magecart-style) attacks. These attacks exploit trust in third-party scripts, injecting malicious code that silently exfiltrates cardholder data without the merchant's knowledge. The core failure in most breaches is the absence of visibility: merchants often have no idea what scripts are running, where they originate, or when they change. This matters because even one compromised third-party dependency can expose every customer who visits a checkout page. Compliance is now a forcing function for supply chain script hygiene that should have been standard practice long ago.