This page, read the same way

paypagewatch.vercel.app/ · read 10 October 2026, 03:28 UTC. Paste your checkout's address above and its scripts take these lines.

Scripts: 2
Third-party hosts: 0
Inline: 0
With SRI: 0
Justification blank: 2

Every script the page ran, one per line
No.	Script	Host	Party	SRI	Justification
1	https://paypagewatch.vercel.app/assets/index-BVt5sKu3.jsmodule script	paypagewatch.vercel.app	First party	no	blank, yours to write
2	https://paypagewatch.vercel.app/assets/labels-DHEGcsGV.jsfetched by another script; no tag in the HTML	paypagewatch.vercel.app	First party	no	blank, yours to write

The page's own headers

Header	On this page	Value
Content-Security-Policynames where scripts may load from	sent	default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; manifest-src 'self'; object-src 'none'; base…
Strict-Transport-Securitykeeps the browser on https	sent	max-age=63072000; includeSubDomains; preload
X-Frame-Optionsstops other sites framing the page	sent	DENY
X-Content-Type-Optionsstops the browser guessing file types	sent	nosniff
Referrer-Policylimits what the next site learns	sent	strict-origin-when-cross-origin

Watch This Page

$49a month, per checkout domain

A signed baseline, then a receipt every Monday

A signed baseline of every script on your checkout page with a justification column, then a fresh read every Monday with the changes mailed to you, and a one-line receipt in the weeks nothing changed.

Free, right now: Every script's address, its host and party, whether it carries SRI, the third-party count and the page's security headers.
In the watch: The SHA-256 of every script, the justification column with each vendor's own documentation, a signature you can check, and the Monday read in your inbox.

Run the free list first. The baseline is the page you just read.

Billed monthly by Stripe. Nothing goes on your page, and no page view is counted.

How the read works

Requirement 6.4.3 asks for a list of every script on the payment page, a written reason for each, and a way to tell it has not been swapped. Requirement 11.6.1 asks for a check, at least weekly, that tells you when the page or its headers change. The revised SAQ A, the short self-assessment a merchant signs when the card form belongs to the processor, asks you to confirm the page is not open to attacks from scripts.

A real browser opens your checkout from our server, waits up to 20 seconds for it to settle, and hashes every script it received with SHA-256. The watch repeats that every Monday and mails you what changed. Nothing goes on your page: a tag on the checkout to watch the checkout is one more script on the list.

The read is from outside, once a week, from one place. It will not see a script swapped for one visitor in one country for one hour, and an assessor can read 11.6.1 as asking for detection inside the shopper's browser. The method page says where that line falls, with the PCI Security Standards Council's own FAQ.