PCI DSS Readiness Scanner

PCI Readiness Scanner

PCI Readiness Scanner runs a passive payment security check on merchant websites: TLS and certificates, security headers, hosted vs on-page card fields, third-party scripts on payment pages and a likely SAQ type, with a readiness score.

Best for: Acquirers and PSPs onboarding e-commerce merchants, merchant risk teams, and agencies reviewing client checkouts.

How to check a checkout's PCI readiness

1. Add sites you own or are authorised to assess to Merchant sites (startUrls).
2. Set Max cart/checkout pages to follow (default 3).
3. Click Start and review readinessScore, likelySaq and findings.

How it works

Passive checks only. It makes normal HTTPS GET requests to public pages plus standard TLS handshakes: no port scanning, fuzzing, form submission or login. It doesn't run JavaScript, so card fields injected purely by JS may not be seen and checkout pages behind a basket may be missed. The SAQ suggestion follows the PCI SSC SAQ eligibility logic: redirect or iframe-only points to SAQ A, while JS-built or direct-post fields point to SAQ A-EP and on-page card inputs to SAQ D.

Output

url, readinessScore, readinessBand, likelySaq, saqReasoning, tls, legacyTlsAccepted, securityHeaders, paymentProvidersDetected, rawCardInputsFoundOn, thirdPartyScriptDomains, findings, label

Pricing (pay-per-event)

• site-scanned: $0.02 per result ($20 / 1,000). Platform usage is included; you pay only for results.
• Example: 10,000 sites cost $200.00.

Example input

{
  "startUrls": [
    {
      "url": "https://sauce-demo.myshopify.com"
    },
    {
      "url": "https://example.com"
    }
  ],
  "maxPaymentPages": 3
}

Example output

Values below are illustrative.

{
  "url": "https://www.example.co.uk",
  "readinessScore": 82,
  "readinessBand": "good",
  "likelySaq": "A (likely)",
  "saqReasoning": "Card fields appear to be PSP-hosted iframes...",
  "tls": {
    "tlsVersion": "TLSv1.3",
    "certDaysLeft": 60
  },
  "legacyTlsAccepted": {
    "TLSv1": false,
    "TLSv1.1": false
  },
  "securityHeaders": {
    "strict-transport-security": "max-age=31536000"
  },
  "paymentProvidersDetected": [
    {
      "provider": "Stripe",
      "integration": "iframe-fields"
    }
  ],
  "rawCardInputsFoundOn": [],
  "thirdPartyScriptDomains": [
    "www.googletagmanager.com"
  ],
  "findings": [
    "Missing content-security-policy header"
  ],
  "label": "Readiness indicator only - NOT a PCI DSS compliance assessment..."
}

Use it via API, schedules and integrations

Run it in Apify Console, or call it from your own code with the Apify API or the Python and JavaScript clients. Save an input as a task and add a schedule to run it regularly, and send results to Slack, email, webhooks, Zapier, Make or n8n with Apify integrations. AI agents can find and run it through the Apify MCP server.

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("sterlingverify/pci-readiness-scanner").call(run_input={"startUrls": [{"url": "https://www.example.com"}]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

Use in Clay, Zapier, Make, n8n, Pipedream, Power Automate or Activepieces

All of them connect to Apify through their official Apify integrations, using your own Apify account: an API token from Apify Console > Settings > API & Integrations, or Apify sign-in for Power Automate. Runs bill to your Apify account at this Actor's pay-per-event price.

• Clay: save this Actor's input as an Apify task and copy it as JSON. In your Clay table, add the Run Apify Actor enrichment, choose it and paste the JSON into Input Data, mapping Clay columns into the fields. To pull a finished run into a new table, use the Import data from Apify Actor source.
• Zapier: use the Apify Run Actor action, or the Finished Actor run trigger followed by Fetch dataset items. Synchronous runs in Zapier stop after 30 seconds, so use the trigger for big batches.
• Make: add the Apify Run an Actor module with Run synchronously set to Yes, then Get Dataset Items with the run's dataset ID. For longer runs, use the Watch Actor Runs trigger.
• n8n: install the Apify node (@apify/n8n-nodes-apify, or search "Apify" on n8n Cloud) and use Run an Actor and get dataset.
• Pipedream: add the Apify app's Run Actor action, or Run Task Synchronously on one of this Actor's public example tasks (or your own saved task) to get the dataset items back in one step. For big batches, start from the New Finished Actor Run or New Finished Task Run trigger, then Get Dataset Items.
• Power Automate: add the Apify connector (a premium connector, currently in preview) and sign in with your Apify account. Use Run Actor with Enter custom value set to sterlingverify/pci-readiness-scanner and paste the input as JSON, then Get dataset items with the run's default dataset ID. For big batches, start the flow from the Actor run finished trigger instead.
• Activepieces: add the Apify piece and use Run Actor, or Run Task on one of this Actor's public example tasks (or your own saved task), then Get Dataset Items. For scheduled or big batches, use the Watch Actor Runs or Watch Task Runs trigger.
• Google Drive / Sheets: add Apify's Upload results to GDrive integration to a scheduled task to drop each run's CSV or XLSX into your team's Drive, or chain the Google Sheets Import & Export actor to append rows to a sheet.
• Slack alerts: add Apify's Slack integration to a scheduled task to post each run's results to your team channel, or start a check from Slack with /apify call and your task ID.
• Any HTTP tool or script: send one request and get the results back as JSON. Runs must finish within 5 minutes.

curl -X POST "https://api.apify.com/v2/acts/sterlingverify~pci-readiness-scanner/run-sync-get-dataset-items" \
  -H "Authorization: Bearer YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d @input.json

FAQ

Is this a PCI DSS compliance assessment?

No. It is a readiness indicator only, not a QSA/ISA review or ASV scan, and it does not certify compliance.

Does it scan ports or submit forms?

No. It makes normal HTTPS GET requests and standard TLS handshakes only.

Disclaimer

Readiness indicator only. This is NOT a PCI DSS compliance assessment, QSA/ISA review, or ASV scan, and the result does not certify compliance. Your acquirer and a qualified assessor determine your SAQ type and compliance. Scan only sites you own or are authorised to assess (e.g. merchants you onboard). Not affiliated with the PCI Security Standards Council. PCI DSS is a trademark of PCI SSC.

Related sterlingVerify tools

Part of the sterlingVerify UK payments, KYB and data toolkit on Apify Store:

• Merchant Website Compliance Checker for Onboarding: onboarding review of a merchant's website
• SSL Certificate Expiry Monitor: bulk SSL certificate expiry checks and alerts
• Payments Stack Detector: find which PSPs, wallets and BNPL a store uses
• MCC Checker: check a merchant's MCC against its website or description