PCI DSS 6.4.3 Script Inventory & Scanner

PCI DSS 4.0.1 requirement 6.4.3 asks every business that takes card payments online to keep an inventory of the scripts on its payment pages, with a written justification for each, plus integrity checks. This produces that inventory from the page as your browser actually rendered it — including scripts a tag manager injected at runtime, which a server-side scan cannot see. Click Scan and it lists every script: the vendor, what it does, a **drafted business justification for you to approve**, and a SHA-256 fingerprint. Anything it doesn't recognise says so rather than guessing. Embedded payment iframes (e.g. Stripe) are named as the provider's scope, not yours. It **never states that you are compliant** — that is your assessor's judgement. It fully supports the 6.4.3 inventory; the seven-day change check of 11.6.1 it *assists* (you run it), because there is no server. ⏳ Free for 7 days — every feature, no card needed. ⭐ Then $2.99/month, or $29.90/year (two months free). Cancel any time.