ScriptPatrol watches every script on your checkout, login and account pages and alerts you when one is changed or added — the first sign of a skimmer or a compromised third-party. The attack runs in your customer's browser, where your server and firewall never look.
No credit card required · Set up in under 5 minutes · Works behind Cloudflare
See and protect every script your customers actually run — no code changes required.
Point ScriptPatrol at your checkout, login or admin pages. Automatic path discovery does the rest in under a minute.
ScriptPatrol inventories and hashes every script, then grades each page on headers, TLS and live script integrity.
Any unexpected or changed script triggers an email and Slack alert with a risk score and a clear next step.
A single compromised third-party script can quietly skim card and login data from every visitor until it's found. Continuous client-side monitoring closes that gap.
Visibility Into Every Script You Ship
Spot Magecart and unauthorized JavaScript on your most sensitive pages — with a clear Security Score and audit-ready reports, and no work added to your team.
The same data that powers detection also produces the script-inventory and change-detection evidence PCI DSS asks for. This applies to merchants who file SAQ A-EP or SAQ D; merchants on SAQ A (hosted or redirect payment pages) have not needed requirements 6.4.3 or 11.6.1 since March 31, 2025 — but client-side monitoring still protects your customers either way.
A documented inventory of every script on the page, which ScriptPatrol maintains automatically:
A mechanism that detects unauthorized changes to the page, which ScriptPatrol runs continuously:
ScriptPatrol provides the technical controls and exportable evidence for both requirements.
Engineering Insights
Deep dives into the technical challenges of client-side security monitoring and how we solve them.
You do not need to be a developer to protect your site. A plain-English guide for website and online-shop owners: what the JavaScript on your pages actually does, what can go wrong, how attackers steal cards and credentials through it, and the four simple questions you should be able to answer about your own site this week.
A clear, readable map of what ScriptPatrol monitors today on any kind of website — e-commerce, banking, SaaS, healthcare, government: multi-layer discovery of your critical pages, script intelligence across known vendors, the full set of HTTP security headers, smart change triage, and tamper-evident evidence.
Continuous monitoring of the JavaScript running on your checkout, login, and admin pages is free during our open beta. No credit card, no expiring trial. Here is why client-side monitoring matters, what good looks like, and how to switch it on for your store in minutes.
Client-Side Security, Answered
Everything you need to know about how ScriptPatrol monitors the scripts your customers run.
See every script your customers actually run within 24 hours, and get an alert when something changes. Continuous client-side monitoring with a clear Security Score.
