PCI Readiness Scanner

PCI Readiness Scanner runs a passive payment security check on merchant websites: TLS and certificates, security headers, hosted vs on-page card fields, third-party scripts on payment pages and a likely SAQ type, with a readiness score.

Best for: Acquirers and PSPs onboarding e-commerce merchants, merchant risk teams, and agencies reviewing client checkouts.

How to check a checkout's PCI readiness

1. Add sites you own or are authorised to assess to Merchant sites (startUrls).
2. Set Max cart/checkout pages to follow (default 3).
3. Click Start and review readinessScore, likelySaq and findings.

How it works

Passive checks only. It makes normal HTTPS GET requests to public pages plus standard TLS handshakes: no port scanning, fuzzing, form submission or login. It doesn't run JavaScript, so card fields injected purely by JS may not be seen and checkout pages behind a basket may be missed. The SAQ suggestion follows the PCI SSC SAQ eligibility logic: redirect or iframe-only points to SAQ A, while JS-built or direct-post fields point to SAQ A-EP and on-page card inputs to SAQ D.

Output

url, readinessScore, readinessBand, likelySaq, saqReasoning, tls, legacyTlsAccepted, securityHeaders, paymentProvidersDetected, rawCardInputsFoundOn, thirdPartyScriptDomains, findings, label

Pricing (pay-per-event)

• site-scanned: $0.02 per result ($20 / 1,000). Platform usage is included; you pay only for results.
• Example: 10,000 sites cost $200.00.

Example input

{
  "startUrls": [
    {
      "url": "https://sauce-demo.myshopify.com"
    },
    {
      "url": "https://example.com"
    }
  ],
  "maxPaymentPages": 3
}

Example output

Values below are illustrative.

{
  "url": "https://www.example.co.uk",
  "readinessScore": 82,
  "readinessBand": "good",
  "likelySaq": "A (likely)",
  "saqReasoning": "Card fields appear to be PSP-hosted iframes...",
  "tls": {
    "tlsVersion": "TLSv1.3",
    "certDaysLeft": 60
  },
  "legacyTlsAccepted": {
    "TLSv1": false,
    "TLSv1.1": false
  },
  "securityHeaders": {
    "strict-transport-security": "max-age=31536000"
  },
  "paymentProvidersDetected": [
    {
      "provider": "Stripe",
      "integration": "iframe-fields"
    }
  ],
  "rawCardInputsFoundOn": [],
  "thirdPartyScriptDomains": [
    "www.googletagmanager.com"
  ],
  "findings": [
    "Missing content-security-policy header"
  ],
  "label": "Readiness indicator only - NOT a PCI DSS compliance assessment..."
}

Use it via API, schedules and integrations

Run it in Apify Console, or call it from your own code with the Apify API or the Python and JavaScript clients. Save an input as a task and add a schedule to run it regularly, and send results to Slack, email, webhooks, Zapier, Make or n8n with Apify integrations. AI agents can find and run it through the Apify MCP server.

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("sterlingverify/pci-readiness-scanner").call(run_input={"startUrls": [{"url": "https://www.example.com"}]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

FAQ

Is this a PCI DSS compliance assessment?

No. It is a readiness indicator only, not a QSA/ISA review or ASV scan, and it does not certify compliance.

Does it scan ports or submit forms?

No. It makes normal HTTPS GET requests and standard TLS handshakes only.

Disclaimer

Readiness indicator only. This is NOT a PCI DSS compliance assessment, QSA/ISA review, or ASV scan, and the result does not certify compliance. Your acquirer and a qualified assessor determine your SAQ type and compliance. Scan only sites you own or are authorised to assess (e.g. merchants you onboard). Not affiliated with the PCI Security Standards Council. PCI DSS is a trademark of PCI SSC.

Related sterlingVerify tools

Part of the sterlingVerify UK payments, KYB and data toolkit on Apify Store:

• Merchant Website Compliance Checker for Onboarding: onboarding review of a merchant's website
• SSL Certificate Expiry Monitor: bulk SSL certificate expiry checks and alerts
• Payments Stack Detector: find which PSPs, wallets and BNPL a store uses
• MCC Checker: check a merchant's MCC against its website or description