Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

According to Web Almanac, the top 1,000 websites load an average of 43 third-party domains on mobile and 53 on desktop, each a potential entry point for supply-chain tampering. A separate analysis found that most enterprise sites include 12 third-party and 3 fourth-party scripts in sensitive user journeys. That’s 15 external execution paths per transaction, and every one of them runs in the same browser as your checkout.

Many teams believe that cross-site scripting, or XSS, is a problem of the past. Modern frameworks promise built-in protections, and developers often assume the browser will handle the rest. The reasoning sounds logical: if React auto-encodes output, XSS can’t happen. However, XSS prevention doesn’t work on assumptions; it works on visibility. We’ve learned that XSS prevention is about maintaining continuous control over the browser environment where your application runs.

Many teams assume that embedding payment forms in an iframe keeps them compliant with PCI DSS 4.0.1, Requirement 6.4.3. The reasoning sounds logical – compliance seems guaranteed if card data never reaches your infrastructure. However, iframe payment security PCI DSS 6.4.3 doesn’t work on assumptions; it works on control. The responsibility shifts to new layers of your website’s supply chain.

PCI DSS 4.0.1 became mandatory on March 31, 2025, bringing in 47 new requirements that fundamentally changed how compliance works. Organizations that treated PCI as an annual audit exercise now face a standard that expects real-time visibility into payment pages. Requirements 6.4.3 and 11.6.1 are the most impactful additions, which require real-time visibility into scripts and payment page changes. A spreadsheet updated quarterly can’t deliver that.

Tell me if you’ve heard this one before: a company audits its checkout page and discovers 47 scripts running. Only 12 were approved. The other 35? A mystery, and a risk. Nobody knows who added them or whether they’ve been compromised. That’s what we’re here to talk about today.

PCI audits are not designed to protect your organization. They are designed to protect the payment card industry. This misalignment exists because card brands bear the burden of fraud-related costs, so the framework is built to minimize their exposure rather than address the unique risks merchants face. For example, PCI DSS focuses heavily on infrastructure and network security, reflecting a time when payment processing happened in secure, on-premise environments.

The stakes for protecting payment data have never been higher. In 2024, the global average cost of a data breach reached $4.88 million, a 10% increase over the previous year (IBM). For any business handling credit card transactions, PCI DSS compliance certification is essential to safeguard customer trust, meet regulatory obligations, and prevent costly breaches.

Running a site that processes payments can be risky. Hidden scripts from ads, chat widgets, and third parties can expose your business to security attacks, such as Magecart and e-skimming. PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1, which are mandatory as of March 31, 2025, require live script inventories, approvals, and real-time change alerts. The solution: A PCI DSS compliance software that tracks, verifies, and blocks tampering in real time.

For many U.S. companies, the answer is yes—and not just those physically located in Connecticut. Like the CCPA in California or the CPA in Colorado, the Connecticut Data Privacy Act has an extraterritorial reach, meaning if your website, SaaS platform, or e-commerce business processes Connecticut residents’ personal data at scale, compliance is mandatory. The problem? CDPA compliance is rarely straightforward.

PCI DSS 6.4.3 requires organizations to maintain integrity controls over all JavaScript running on payment pages, while 11.6.1 requires continuous monitoring and alerting for script changes. For hospitality brands, compliance is harder than in other industries because: The result: Security teams struggle with fragmented visibility, manual evidence collection, and constant alerts during audits.