PCI DSS v4.0.1 Now Mandates Payment Page Script Monitoring: QSA Validates Reflectiz Platform

The Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 has introduced two critical requirements—6.4.3 and 11.6.1—that directly address the risk of web skimming and Magecart attacks on checkout pages. These requirements mandate that merchants inventory every script on payment pages, authorize them, prove their integrity, and detect tampering with page content and HTTP headers in real time. Independent PCI Qualified Security Assessor (QSA) Integrity360 Europe reviewed the Reflectiz PCI DSS Platform and found it effectively supports compliance with both requirements. The platform monitors script behavior rather than just file hashes, deploys agentlessly without code changes, and produces QSA-ready audit evidence. The article also highlights that since January 2025, merchants using SAQ A must confirm their site is not susceptible to script attacks, with PCI SSC FAQ #1588 clarifying that embedded payment iframes still require these controls. This development is significant for e-commerce security, as Sansec reports over 100,000 sites have been hit by web skimming, and the 2018 British Airways breach exposed 380,000 transactions.