Since 31 March 2025 two PCI DSS requirements have applied to the page your customers type their card into. 6.4.3 wants every script on that page inventoried, authorised and integrity-assured. 11.6.1 wants tamper detection on it, checked weekly. In January 2025 the Council also revised SAQ A, replacing those requirements with an eligibility criterion you must be able to affirm before you may use the short questionnaire at all.

Everything written about this is either from a scanning vendor selling scans, or from a gateway telling you it is handled. Neither shows you the script boundary on your own page. This guide is written by people who build payment integrations for four different carts, and it is about your markup.

What it answers

Which questionnaire you are eligible for, and why — the gap between SAQ A and SAQ A-EP is a couple of dozen questions versus well over a hundred plus quarterly scanning, and it is decided by markup you can read in thirty seconds. Where your payment page actually is, which for most gateways is not /checkout. Which of four integration shapes each of your payment methods is in, and what each shape obliges you to do. How to build the inventory, detect change, and write a policy that does not silently kill the pay button.

Written against real code

Every example comes from a shipped integration, not a sketch. The webhook chapter walks a real signature-verification handler line by line — verify before you parse, bind to the order key, make a replayed success impossible to settle twice. The chapter on script integrity is the one nobody else writes: Subresource Integrity is the obvious answer to "assure the integrity of each script", and for your provider's CDN script it is usually impossible, because that file carries no version and changes without notice. What to do instead.

Twelve chapters and five appendices

What your acquirer will ask · Find your payment page · The four integration shapes · Build the script inventory · Why you cannot SRI your processor · Tamper detection a weekly check will pass · A CSP that does not break checkout · Webhooks, signatures and replay · Secrets and the test/live split · Proving it with a mock provider · Filling the questionnaire · Keeping it true. Plus the inventory worksheet, the letter template for asking your provider to confirm payment-page protection, a one-page decision chart, a per-gateway reference table, and per-cart notes for WooCommerce, OpenCart, PrestaShop and 1C-Bitrix.

Read the first three chapters free

Chapters 1 to 3 are the ones that tell you where you stand — including the ten-second check that decides which questionnaire you are eligible for. Read them now: the whole thing is on this site, with no email required and nothing to sign up for. If they are not useful to you, the rest of the book will not be either.

Short on purpose

Fifty-nine pages. This is a working guide, not a textbook: every chapter exists because there is something to do, and the padding that would take it to two hundred pages is exactly the PCI boilerplate you can already read for free on the Council's own site. What you are paying for is the part nobody else has written down — which page is actually your payment page, why hash-pinning your processor's script breaks checkout, and the inline-nonce trap that makes a weekly tamper check cry wolf until you stop reading it.

Good to know

This is an implementation guide written by integrators. It is not a QSA opinion and it cannot be one: your acquirer, not this book and not your gateway, decides which questionnaire applies to you. Every date and quotation is cited to PCI SSC primary sources so you can check it, because secondary sources on this subject contradict each other routinely. Buyers get the revisions when PCI is revised.