PCI Payment Page Script Audit

It reads a checkout or payment HTML file and applies 15 static rules drawn from PCI DSS v4.0.1 Requirements 6.4.3 and 11.6.1. Each finding names the line number, the requirement it maps to, and the fix. On the bundled 31-line generated checkout page it returns 18 findings, 12 of them blocking.

Web developers and agencies who maintain checkout pages for ecommerce merchants, and in-house teams preparing an SAQ A-EP or a QSA assessment. If you ship the HTML that renders or wraps a card field, these two requirements are yours to satisfy, not your payment provider's.

ESLint and htmlhint check syntax and style, not payment scope. A chatbot cannot tell which page in your repository takes the card, and will happily emit a CDN script tag with no integrity hash. These rules are about a specific page under a specific standard, applied to your file.

The free extension and the free web page run all 15 rules on the file you have open and show every finding. Nothing is hidden or watermarked. The $29 licence adds a different job: one pass over every payment page in the repository, and a dated script inventory and justification file you export and keep.

A QSA gap assessment limited to the payment-page requirements is typically quoted from about $5,000 for a single storefront, and a repeat visit after remediation costs again. Building the script inventory by hand means reading every checkout template and recording each tag, which is where most of that time goes.