ScriptPatrol watches every script on your checkout, login and account pages and alerts you when one is changed or added, the first sign of a skimmer or a compromised third party. The attack runs in your visitor's browser, where your server and firewall never look.
For any website that loads third-party scripts: checkouts, logins, SaaS, content and marketing sites alike.
Free during beta · No credit card · First scan in about a minute
See every script your customers run, and get told when one changes, with no code on your site.
Point ScriptPatrol at your checkout, login or admin pages. Automatic path discovery does the rest in under a minute.
ScriptPatrol inventories and hashes every script, then grades each page on headers, TLS and live script integrity.
When a scan finds a changed or unexpected script worth your attention, you get an email with a risk score and a clear next step. In a site’s first week only critical findings are emailed.
A single compromised third-party script can skim card and login data from every visitor until someone notices. During the open beta, ScriptPatrol checks checkout and login pages every four hours, and every other page once a day.
Every script your pages load, in plain sight
Spot Magecart and unauthorized JavaScript on your most sensitive pages, with a clear Security Score and audit-ready reports, and no work added to your team.
When you have to prove what was running, and watch the environments the public never sees, ScriptPatrol gives you evidence you can verify yourself and access your network team controls.
Every exported report carries a SHA-256 Merkle root that proves its contents are intact, and anyone can recompute it. When a trusted timestamp is available, the report is also sealed with an RFC 3161 token from a public authority that proves when it was recorded. Both are verifiable with standard, open tools.
Point ScriptPatrol at a staging, integration, or access-restricted environment and let us in the way your security team prefers: a per-site secret header or a mutual-TLS client certificate. Nothing is installed on the environment itself.
The same data that powers detection also produces the script-inventory and change-detection evidence PCI DSS asks for. This applies to merchants who file SAQ A-EP or SAQ D; merchants on SAQ A (hosted or redirect payment pages) have not needed requirements 6.4.3 or 11.6.1 since March 31, 2025. Client-side monitoring still protects your customers either way.
A documented inventory of every script on the page, which ScriptPatrol maintains automatically:
A mechanism that detects unauthorized changes to the page, which ScriptPatrol runs continuously:
ScriptPatrol provides the technical controls and exportable evidence for both requirements.
Built for: Magecart detection · Supply-chain monitoring · Data-flow mapping · Runtime CSP detection · Security Score · Verifiable evidence · Restricted environments · PCI DSS evidence (SAQ A-EP/D)
Notes from the build
How the detection works, how we scan behind firewalls, and what we're shipping next.
Engineering
An ad pixel can read the email addresses customers type into a login form, much as a skimmer reads a checkout. Telling the two apart means reading the code. How our AI agent does that reading, and why no single AI answer is trusted.
Product Update
ScriptPatrol has been in free open beta since May 17, 2026. What changed over the summer, with numbers: change emails fell from 69 in a month to two in twelve days, and scans now say when they could not see a page.
Security Strategy
Almost every scan finds a changed script, and almost none of those changes are attacks. Which changes deserve an email, and how to tell whether the alerts you get are worth reading.
Client-Side Security, Answered
How the monitoring works, what it catches, and what it costs.
We inventory every script your customers run within 24 hours. After the site's first week, we alert you as soon as a scan detects one changed or added, the first sign of a skimmer.
