ScriptPatrol is often introduced as a tool for e-commerce checkout pages, but that undersells what the platform actually does. It is a continuous client-side security monitor for any website that has critical user flows: e-commerce checkouts, online-banking login, SaaS dashboards, healthcare patient portals, government identity pages, internal admin consoles. Wherever a single malicious script could harm the user or the business, ScriptPatrol watches.
This article is a map of what the platform monitors today and what you get from it. It is intentionally light on internal engineering, which is a competitive moat, and focused on the outcomes.
0. Who needs this, beyond e-commerce
Magecart and similar JavaScript supply-chain attacks made checkout pages famous, but the same attack mechanics apply anywhere a sensitive form runs in the browser. Five categories of site benefit from continuous client-side monitoring:
Checkout, cart and customer account pages: the canonical Magecart targets, and the merchants covered by PCI DSS 6.4.3 / 11.6.1.
Login pages, money-transfer flows and statement downloads: high-value targets where a single rogue script can intercept credentials or transactions.
Tenant dashboards, billing portals and super-admin tools. A compromised tag manager here exfiltrates entire customer databases.
Patient portals, eGovernment identity flows and benefits applications: pages with regulated data that must not leak to unknown third parties.
Heavy tag-manager and analytics use means lots of moving JavaScript and high vendor churn. A continuous inventory catches both performance regressions and unauthorized additions.
1. How the platform is wired (the 30-second tour)
ScriptPatrol runs as a hosted service. You point it at a domain, or install the Shoptet add-on (currently in pilot) for one-click setup, and the platform takes care of the rest. At a high level, three components cooperate:
- API layer: handles authentication, site registration, schedules, report generation, and the dashboard. It is the only part of the platform you ever interact with directly.
- Discovery and scanning: ScriptPatrol discovers your critical pages and scans each one daily, producing a complete inventory and a diff against the previous baseline, with no embedded JavaScript tag on your site.
- Detection and evidence: change detection, vendor matching, malicious-pattern checks, header drift, the Security Score, and a tamper-evident, timestamped change history all live here.
All you ever see is the dashboard and the alerts. The architecture matters because it is tamper-proof from the outside: you do not embed any of our JavaScript on your pages, so an attacker who compromises your site cannot also disable the monitor. That is a deliberate design choice and one we wrote about in detail in our piece on why an embedded JS tag is the wrong way to monitor your scripts.
2. Discovery: finding what is worth monitoring
Monitoring is only as good as the pages you point it at. A homepage scan tells you very little; the real attack surface lives on the small set of pages where users authenticate, transact, or administer the site. ScriptPatrol discovers those pages automatically on every new site, so you do not have to map them by hand:
Checkout, cart, login, account, password reset, admin and common API endpoints, the high-value flows where a malicious script does real damage, are located automatically even when they are buried deep in the site.
Discovery handles very large sites efficiently and politely, mapping the critical attack surface without crawling like a runaway bot or hammering your servers.
ScriptPatrol works with modern JavaScript frameworks, so it can reach pages that are never plainly linked from the homepage, such as deep account settings, admin sub-routes and similar hidden flows.
ScriptPatrol recognizes common e-commerce platforms (Shopify, WooCommerce, Magento, PrestaShop, Shoptet and similar) and uses that to surface the critical pages specific to each one.
Discovery is also multilingual. ScriptPatrol recognizes what each page does (checkout, login, registration, password reset, account, admin) across many languages, which English-only tools routinely miss on non-English sites.
A short list, on purpose
ScriptPatrol shows a short list of the pages that matter: checkout, login, account, admin. It does not pad that list with low-value URLs.
3. The scan: what we capture per page
Each monitored page is scanned daily in a real browser, the way a visitor loads it, so JavaScript executes, app routes resolve, lazy-loaded scripts are observed, and cookies are captured. Every scan produces a complete record:
- All external
<script src>URLs, each fingerprinted with a SHA-256 hash of its loaded content, plus load method (sync / async / defer / dynamic), SRI hash, and HTML attributes (crossorigin,nonce,integrity,type) - All inline scripts (content-hashed, with size, integrity fingerprint and a preview), so edits to the bytes of the page are captured as well as URL changes
- The HTTP security headers: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy
- TLS posture, outbound redirects (chain, hop count, type), unexpected destination domains, and mixed-content events (HTTP loads on HTTPS pages)
Set-Cookieheaders and cookie flags, HTTP status, and response timing for trend analysis
It works on most sites behind Cloudflare. Because ScriptPatrol loads your pages in a real browser, the way a visitor would, most protected pages can still be inventoried with no IP allowlisting, no JavaScript tag on your site, and no weakening of your security configuration. If a firewall still blocks the scanner, Scanner Access in the dashboard shows how to let it through. We cover what this means for you in our piece on scanning behind Cloudflare.
Blocked scans are reported as blocked
Every scan result is checked before it can become a baseline. If the captured content matches a bot-mitigation page we recognize, the scan is discarded and retried, and a scan that still can't get through is recorded as blocked, never as a success. The check only knows the pages it has seen, so we keep adding new ones.
4. Detection: the layers that read meaning into the inventory
The inventory is one half of the job. The other half is reading meaning into it. Each new scan is compared against the stored baseline and run through several detectors in parallel:
Script change detection
Added, removed and modified scripts (by content hash) are reported with a full diff. Inline-script edits are compared at the byte level, so an injection cannot hide behind an unchanged filename. Diffs are stored, viewable, and exportable.
Magecart and skimmer patterns
Known malicious code patterns (card-data exfiltration to unusual domains, form-field listeners attached to checkout or login inputs, base64-encoded payload obfuscation, suspicious WebSocket and beacon usage) are matched against the full content of every new or changed script. Suspect matches are escalated as CRITICAL alerts and never delayed by learning-mode windows.
Vendor and supply-chain risk
Each external script is matched against a curated database of known vendors: analytics, payments, CDN, A/B testing, chat, tag managers, consent platforms and customer-data platforms. Unknown domains are checked for look-alike or impersonating names against the trusted set. New fourth-party loads (a known vendor that begins pulling in a previously unseen third party) are surfaced explicitly, because that is the classic compromise path.
Security header drift
CSP, HSTS, X-Frame-Options, and friends are tracked as their own baseline. Weakening a CSP (loosening script-src, removing frame-ancestors) or removing HSTS is treated as a high-severity event, even if no script changed.
Redirect & domain-reputation analysis
The outbound destinations the page contacts are mapped and screened. New redirect chains, freshly registered destination domains, domains on known-malicious host feeds, and domains with no reputation history are surfaced for review, even if no script tag changed and the headers look fine.
Security Score
Every site receives a per-path and overall A+ to F grade, blending header hardening, vendor risk, change volatility, and detector findings. The score is the single-glance answer to “is this site getting better or worse?” over time, and a simple reporting line item for security and executive stakeholders.
5. Smart change triage: fewer, better alerts
Real websites change constantly. Tag managers rotate URLs every deploy. Analytics vendors cache-bust their scripts. CDNs append fingerprints. Flagging every diff produces a review queue no one ever reads. ScriptPatrol is built so the alert flow stays trustworthy:
- Routine, repetitive changes are recognized. Cache-busting, version suffixes, query-string churn and token rotations are treated as the same script and resolved automatically. They are excluded from both the alert flow and risk scoring, so they never reach your inbox.
- Noise is told apart from signal. A script that has changed constantly for weeks is treated differently from one that has been stable for months and suddenly changes. The first is background noise; the second belongs at the top of the queue.
- Learning mode: on a new site, ScriptPatrol first observes what is “normal” before it starts alerting, the way a careful analyst learns a site before paging anyone. Suspected malicious patterns bypass this window and alert immediately.
- WAF-aware allowlist: scripts that belong to your WAF or bot-protection provider are recognized and allowed, so they never count against your Security Score or fill up your alert inbox.
Triage in numbers (two Czech online shops we monitor, May 2026)
The two Czech online shops we monitor, observed in May 2026. Site A's churn was entirely cache-bust and WAF token rotation (correctly auto-resolved). Site B had 411 genuine vendor changes during a marketing-stack rollout (correctly kept).
6. Evidence and compliance: proof that holds up under audit
Detection is useful in the moment; evidence is useful months later when somebody comes asking. ScriptPatrol keeps a tamper-evident, timestamped change history: every scan is stored so that no individual record can be silently altered after the fact, and the chain of evidence stays intact even months later. Reports are exportable as PDF, with a full diff history and a verifiable evidence trail.
For merchants who fall under PCI DSS Requirements 6.4.3 and 11.6.1, the same evidence satisfies the script inventory and change-detection obligations, with nothing for you to assemble by hand. (Note that SAQ A merchants have not needed 6.4.3 or 11.6.1 since March 31, 2025.) If you are unsure whether 6.4.3 and 11.6.1 apply to your business, our PCI DSS script-requirements explainer walks through it in plain language.
7. Built for scale, without slowing anyone down
The platform is designed to keep critical pages monitored on schedule even as the number of sites grows. Three properties make that possible:
- Fair scheduling: work is dispatched so that a single customer with thousands of pages cannot monopolize capacity, and your critical pages are always served first.
- Capacity that flexes with load: the platform scales its scanning capacity up when load grows and back down when it dips, so your pages stay monitored on schedule.
- Polite by design: we monitor your sites the way a careful visitor would, with no surprise traffic spikes and no triggering of your own DDoS protection.
On top of all of that sits an extensive automated test suite that must pass on every change. This is what lets us ship improvements regularly without quietly breaking the things customers already depend on.
For merchants on supported e-commerce platforms, the same architecture is reachable in around two minutes via our native add-on for Shoptet (in pilot, with WooCommerce and PrestaShop in development). The platform is just as useful for any website you can give a URL to.
8. Capabilities at a glance
| Capability | What you get |
|---|---|
| Critical-page discovery | Finds your checkout, login, account and admin flows automatically |
| Language coverage | Recognizes critical pages across many languages |
| Script integrity | Every first- and third-party script tracked by URL + SHA-256, plus inline-script changes |
| Security headers | CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP |
| Transport & cookies | TLS posture, cookie flags, mixed content, unexpected redirects |
| Vendor intelligence | Scripts matched against a curated database of known vendors; look-alike domains flagged |
| E-commerce integrations | Shoptet add-on (pilot); WooCommerce, PrestaShop, Magento 2, BigCommerce and OpenCart in development |
| Behind Cloudflare | Works on most WAF-protected sites with no tag and no IP allowlisting; Scanner Access in the dashboard covers a firewall that still blocks the scanner |
| Monitoring cadence | Daily, with e-mail alerts |
| Alert quality | Routine, repetitive changes auto-resolved; learning mode on new sites |
| Security Score | A+ → F |
| Evidence & reporting | Tamper-evident, timestamped change history; exportable PDF reports and script inventory |
| Compliance | Evidence for PCI DSS 6.4.3 & 11.6.1 where they apply |
Capabilities as of May 26, 2026.
What this adds up to
Most client-side security tools do one piece well: sometimes inventory, sometimes alerting, occasionally compliance reporting. ScriptPatrol is built so the pieces work together: a map of what to watch, an inventory of what runs, an alert when something matters, and evidence when someone asks for proof. None of it needs a JavaScript tag on your site, and it works on most sites behind a WAF.
If you would like to see what your own site looks like through it, the platform is currently in free open beta, with no credit card and no expiring trial. Read more in our open-beta announcement, or sign up and run your first scan in under five minutes.
Frequently asked questions
Is ScriptPatrol only for e-commerce, or for any website?
ScriptPatrol works on any website that has critical user flows: checkout, login, account, password reset, admin, or any page where a malicious script could harm the user or the business. That includes e-commerce, online banking, SaaS dashboards, healthcare portals, and government sites. The detection logic is the same; ScriptPatrol only decides which pages get the highest watch level.
What does ScriptPatrol actually detect on a website?
Every first-party and third-party script loaded on monitored pages (URL + SHA-256 hash), every change to inline scripts, modifications to the HTTP security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy), unexpected redirects, mixed content, known malicious patterns, and vendor risk such as look-alike or impersonating domains and new fourth-party loads.
How does ScriptPatrol find the pages worth monitoring on a new site?
ScriptPatrol discovers the critical pages on a new site (checkout, login, account, password reset, admin and similar flows) and works with modern JavaScript frameworks. It recognizes those pages across many languages, then ranks them by how critical they are so you monitor what matters.
Does ScriptPatrol generate noisy alerts when scripts change frequently?
No. ScriptPatrol recognizes routine, repetitive changes (cache-busting, query-string churn, token rotations) and resolves them automatically so they never reach your inbox. A learning mode observes what is normal for a new site before it starts alerting. On one of the two Czech online shops we monitor, this triage took 28 review-queue items down to 0 without dropping any of the 411 genuine changes detected on the other.
How does ScriptPatrol handle Cloudflare- or WAF-protected pages?
ScriptPatrol loads your pages in a real browser, the way a visitor would, and it works on most sites behind Cloudflare, with no IP allowlisting, no embedded JavaScript tag and no weakening of your security configuration. A scan that runs into a bot-protection page we recognize is recorded as blocked and never stored as a baseline. If your firewall still blocks the scanner, Scanner Access in the dashboard shows how to let it through.
Does the platform produce audit-grade evidence?
Yes. ScriptPatrol keeps a tamper-evident, timestamped change history, so any individual scan record can be verified and the chain of evidence stays intact even months later. Reports are exportable as PDF. For merchants subject to PCI DSS 6.4.3 and 11.6.1 the same evidence satisfies the script inventory and change-detection requirements (note that SAQ A merchants have not needed 6.4.3 or 11.6.1 since March 31, 2025).
See What Runs on Your Site in Under 5 Minutes
Add your domain, let discovery map your critical pages, and get your first Security Score and script inventory.
Start Free, No Card Required