PCI DSS 6.4.3 Script Inventory - Payment Page Script Check

Lists every script that runs on your checkout and payment pages (origin, Subresource Integrity, SHA-256 hash, inline or external) and compares it with the previous run, so you get the script inventory and the change evidence that PCI DSS 4.0 requirement 6.4.3 asks for. Built for small shops, agencies and QSAs who want a pay-per-check report instead of a monthly SaaS subscription.

What it does

1. Opens each URL you give it in a real browser (Playwright / Chrome) and waits for late-loading tags.
2. Inventories every <script> in the page and in its iframes (payment widgets often live in iframes), plus scripts that were loaded dynamically and never appear as a tag.
3. Downloads each external script, computes its SHA-256 and checks it against the integrity attribute when there is one.
4. Compares the inventory with the baseline saved by the previous run and marks every script NEW, CHANGED, UNCHANGED or REMOVED.
5. Raises alerts: third-party scripts without SRI, SRI mismatches, changed scripts, new scripts, origins you did not authorise, missing Content-Security-Policy, non-HTTPS pages.

Schedule it weekly (Apify Schedules) and use the dataset or the alert rows as your tamper evidence.

Input examples

Check two pages and compare with last week:

{ "urls": ["https://shop.example.com/checkout", "https://shop.example.com/payment"] }

Flag every script from a domain you did not approve (Stripe and your own static domain are fine):

{
  "urls": ["https://shop.example.com/checkout"],
  "authorizedOrigins": ["js.stripe.com", "m.stripe.network"],
  "firstPartyDomains": ["static.example-cdn.com"]
}

Keep comparing against an approved baseline instead of the last run (for audits):

{ "urls": ["https://shop.example.com/checkout"], "baselineName": "audit-2026-q4", "updateBaseline": false }

Input guide

Field	Meaning
urls	Your payment / checkout pages. They must be reachable without login.
authorizedOrigins	Domains you approved. When set, other third-party origins raise UNAUTHORIZED_ORIGIN.
firstPartyDomains	Extra domains you own, so they count as first-party.
baselineName	Name of the stored baseline (separate production / staging).
updateBaseline	Save this run as the new baseline (default on).
maxUrls, concurrency, settleSeconds	Size and speed limits.
proxyConfiguration	Optional Apify proxy (off by default).

Output

Two kinds of rows share one dataset (use the pages and scripts views):

type: "page" - one per page: scriptCount, thirdPartyCount, thirdPartyDomains, thirdPartyWithoutSri, sriMismatches, csp, diff (new / changed / removed / unchanged), alerts[].

type: "script" - one per script:

Field	Meaning
scriptUrl, kind	URL, or inline; kind is external or inline
party, domain, origin	first or third party and where it is served from
hasSri, sriValid	Integrity attribute present / matches the served bytes
sha256, sriSha384, bytes	Hash of the served file (SRI-format sha384 too)
diffStatus	BASELINE (first run), NEW, CHANGED, UNCHANGED, REMOVED
loadedVia	script-tag or network-only (injected dynamically)
frame	main or iframe
authorized	On your authorised list (only when you gave a list)

Sample page row (shortened, second run so a diff exists):

{ "type": "page", "url": "https://stripe.com/", "scriptCount": 108, "thirdPartyCount": 101, "thirdPartyWithoutSri": 97,
  "sriMismatches": 0, "csp": { "present": true, "unsafeInline": false },
  "diff": { "new": 0, "changed": 2, "removed": 1, "unchanged": 105 }, "highAlerts": 1,
  "alerts": [ { "severity": "high", "code": "SCRIPT_CHANGED", "message": "2 script(s) have different content (SHA-256) than at the last run." } ] }

Use it with

• Schedule weekly and send the alerts to Slack or email with an Apify integration.
• Google Maps scraper -> a list of shop websites -> this Actor, to audit your clients' sites.
• Pair with a security-headers check to cover requirement 11.6.1 (change and tamper detection of HTTP headers).

FAQ

Does this make me PCI compliant? No. It produces the script inventory and the change evidence; the business justification and authorisation of each script, and the rest of PCI DSS, remain yours.

Why is a hash different between runs although nothing changed? Some scripts are built per request (tokens, timestamps). The row shows the hash so you can judge; add stable versions to your authorised list and review CHANGED rows.

Does it see scripts that only run after login or a filled cart? No. It loads the URL once as an anonymous visitor.

Where is the baseline stored? In a named key-value store pci-script-baselines on your Apify account, one record per URL and baseline name.

Honest limits

• It is an inventory and change check, not real-user monitoring: it sees what one anonymous browser visit loads.
• Inline scripts are matched by hash, so an edited inline block appears as one new and one removed script.
• Scripts larger than 3 MB are listed but not hashed.
• Some sites block datacenter IPs; such pages come back as an error row (free) - use the proxy option.
• Only public pages you supply are loaded. No logins, no bypassing of protections.

Price

Pay per event: $0.01 per page inventoried (the page-inventoried event). Failed pages and the per-script rows are free. Example: 20 checkout pages every week = 20 x $0.01 = $0.20 per run.