PCI DSS 6.4.3 and 11.6.1: securing scripts on payment pages
Requirements 6.4.3 and 11.6.1 protect online payment pages from skimming scripts. 6.4.3 asks you to manage every script that runs on a payment page in the customer's browser. 11.6.1 asks you to detect and alert on unauthorised changes to the page and its HTTP headers. Both became mandatory on 31 March 2025. 1 Sequence Cyber Ltd, a PCI SSC-listed QSA company, assesses both requirements for e-commerce merchants and service providers.Last reviewed: 11 November 2026
Requirement 6.4.3: manage payment page scripts
Every script loaded and run on a payment page in the customer's browser must be:
- authorised, with a method to confirm that;
- checked for integrity, with a method to confirm it has not been altered;
- listed in an inventory, with a written reason why each one is needed.
Requirement 11.6.1: detect changes and tampering
A change- and tamper-detection mechanism must alert staff to unauthorised changes to the HTTP headers and the contents of payment pages, as the customer's browser receives them. It must run at least once a week, or at a frequency set by a targeted risk analysis (Requirement 12.3.1).
Who has to meet them
Since 31 March 2025, merchants using SAQ A no longer validate 6.4.3 and 11.6.1. Instead, they must confirm their site is not susceptible to attacks from scripts that could affect their e-commerce systems. Merchants using SAQ A-EP or SAQ D, merchants with a Report on Compliance, and service providers that host payment pages must still meet both requirements.
What an assessor looks for
- The script inventory, with an owner and a reason for each script.
- How scripts are authorised, for example a Content Security Policy or an approval workflow.
- How integrity is checked, for example Subresource Integrity hashes or a script monitoring tool.
- The 11.6.1 mechanism, its alert records and who responds to them.
- The targeted risk analysis, if the check runs less often than weekly.
Frequently asked questions
Do 6.4.3 and 11.6.1 apply to iframe payment pages?
For merchants that fully outsource payment through an iframe or redirect and qualify for SAQ A, they no longer apply directly; the script eligibility criterion does instead. The payment provider hosting the page must still meet them.
When did they become mandatory?
On 31 March 2025, when the future-dated PCI DSS v4 requirements took effect.
Does a Content Security Policy meet 6.4.3?
It can be part of the method to authorise scripts. The assessor will still look for the inventory, the written justification and the integrity check.