Watching the layer your security stack can’t
ScriptPatrol is an independent, founder-built service that monitors the JavaScript running on your most sensitive pages. That is where a skimmer does its damage, and it is the one place your firewall and server cannot see.
Why ScriptPatrol exists
Your firewall and your server never see the code that actually runs in your visitors’ browsers. That blind spot is exactly where Magecart, formjacking, and e-skimming attacks live. A single tampered or injected script on a checkout or login page can quietly copy card numbers and passwords for months before anyone notices.
The enterprise tools that watch this layer have existed for years, but they are priced and built for large security teams. The small and mid-sized shops handling real payments every day, the ones attackers target because they are softer, were left without an answer they could actually deploy.
ScriptPatrol was built to close that gap: client-side security monitoring that needs no code on your site, works on most sites behind Cloudflare, grades every page from A+ to F, and tells you when a script stops matching a trusted baseline. It can catch a real supply-chain attack, and a one-person shop can turn it on in an afternoon.
What we believe
A few principles that shape every decision, from how we score a page to how we write a line of marketing copy.
Truthful by default
We do not invent threats, inflate detection numbers, or dress up marketing as fact. If a page is clean, we say so. An alert from ScriptPatrol means something real changed.
Nothing to install
ScriptPatrol reads your real pages from the outside, the way a visitor’s browser does. There is no tag, agent or SDK on the pages you are trying to protect, so there is no new performance cost and no new attack surface.
Privacy-first
No tracking cookies and no third-party analytics, on our site or yours. We store script URLs, SHA-256 hashes, and the script content itself (up to 250 KB per script, deduplicated by hash), which is the evidence that lets us prove exactly what changed. We never touch your visitors’ personal data. Data is hosted in the EU.
Built to sit beside your stack
A WAF, a CSP, and a header grader are all worth having. ScriptPatrol is built to complement them and cover the one blind spot they share, and what already works for you stays in place.
Who builds ScriptPatrol
ScriptPatrol is built and run by Martin Stach, an independent founder. It started in 2024 from a simple conviction: the protection that keeps card data and logins safe in the browser should not be a luxury reserved for enterprises. Being founder-built keeps it that way. Decisions are made for the people running the shops we protect, and every claim on this site has to be something we can stand behind.
See what runs on your checkout
Run a free scan of any page and get your A+ to F Security Score, every third-party script identified, and where the page sends data. No account, no card.