PCI DSS 6.4.3 & 11.6.1 Solutions Compared (2026)

PCI DSS 6.4.3 and 11.6.1 Compliance Solutions Compared: Reflectiz, c/side, Feroot, Jscrambler, Source Defense, and Cloudflare (2026)

TL;DR

• PCI DSS requirements 6.4.3 and 11.6.1 became mandatory on March 31, 2025 under PCI DSS v4.0.1. You must inventory and justify every payment page script, verify its integrity, and detect unauthorized changes to scripts and HTTP headers as received by the consumer browser.
• Six purpose-built solutions dominate evaluations: Reflectiz, c/side, Feroot, Jscrambler, Source Defense, and Cloudflare Client-Side Security Advanced.
• The core architectural divide is where the tool runs. Agent, tag, and proxy tools put code inside your payment environment. Reflectiz is the only fully remote solution: no code changes, no agent, and zero access to payment data, session data, or PII.
• Reflectiz is a Principal Participating Organization (PPO) in the PCI Security Standards Council, has been independently assessed against both requirements by Integrity360 Europe, a PCI QSA Company and Global Executive Assessor Roundtable member, deploys in under 24 hours, and is the only vendor in this comparison with published customer audit outcomes: zero observations across every published case study, including Level 1 assessments.
• Neither 6.4.3 nor 11.6.1 requires script blocking. They require inventory, justification, integrity verification, and change detection with alerting. Buy for what the standard demands and for what your QSA will accept as evidence.

Contents

• What PCI DSS 6.4.3 and 11.6.1 Require
• Comparison Table: PCI DSS 6.4.3 and 11.6.1 Solutions
• The Real Architectural Divide: Code on the Page vs. No Code at All
• Vendor Profiles
• Detection vs. Blocking: What the Standard Actually Requires
• The SAQ A Consideration
• How to Choose
• What Verified Reviewers and Independent Sources Say
• Watch: PCI DSS 6.4.3 and 11.6.1 in Practice
• Get Audit-Ready Before Your QSA Arrives

What PCI DSS 6.4.3 and 11.6.1 Require

Requirement 6.4.3, payment page script management. Every script loaded and executed in the consumer’s browser on payment pages must be:

• Authorized: explicitly approved by the organization
• Integrity-assured: verified as untampered
• Inventoried: listed with a written business or technical justification

Requirement 11.6.1, unauthorized change detection. You must deploy a mechanism that detects and alerts on unauthorized modifications to security-impacting HTTP headers and the contents of payment pages, as received by the consumer browser. Checks must run at least every seven days, or more often if your targeted risk analysis requires it.

The phrase “as received by the consumer browser” matters. Server-side scanning is not enough. You need visibility into what actually renders for the customer, which can differ from what your server hosts, especially during a supply chain compromise or CDN-level injection. The risk is not hypothetical: the 2024 Polyfill.io supply-chain attack injected malicious code into scripts trusted by more than 100,000 sites.

The scale of the problem is why automation is the default answer. Reflectiz research across 4,700 monitored websites found that roughly 30% of third-party scripts change within two weeks of deployment, and more than half of third- and fourth-party applications access sensitive data with no documented business justification. Tracking that manually across every payment page is not a realistic weekly task for any security team.

Comparison Table: PCI DSS 6.4.3 and 11.6.1 Solutions

Capabilities below reflect publicly documented product architectures and published customer outcomes as of 2026. Confirm specifics with each vendor for your deployment context.

¹ QSA solution assessments and technical reviews evaluate platform capabilities against the requirements. None constitutes a formal PCI DSS certification or compliance determination for a specific customer environment.

The Real Architectural Divide: Code on the Page vs. No Code at All

Most comparisons sort these tools into “scanner,” “agent,” and “proxy.” That framing misses the question your risk team will actually ask: does the compliance tool itself become part of your cardholder data environment?

• On-page tools (Feroot, Source Defense, Jscrambler agent mode): a JavaScript tag runs in the consumer’s browser alongside payment scripts. Strong runtime visibility, but the tag is one more third-party script on the page 6.4.3 exists to police, and it can observe the payment session.
• Proxy tools (c/side): the platform sits between third-party scripts and the browser, seeing every payload in real time. Powerful, but all script traffic, including on payment pages, routes through the vendor’s infrastructure.
• Network-layer tools (Cloudflare): monitoring rides on the CDN. Convenient if you already run Cloudflare; a major infrastructure migration if you don’t.
• Fully remote (Reflectiz): synthetic user monitoring scans payment pages from the outside, exactly as a real visitor’s browser receives them, including iFrame-embedded and fourth-party scripts. No agent, no tag, no proxy, no access to transactions, sessions, or PII, and zero page performance impact.

This was the deciding factor for Apexx Global, a UK payment orchestration platform subject to Level 1 PCI DSS. Its Head of Information Security selected Reflectiz specifically because no agent-based alternative could monitor payment pages without access to transaction data. Deployment took under 24 hours. The Level 1 audit produced zero observations.

The “periodic crawler” objection, answered. Agent and proxy vendors — cside’s comparison among them — argue that external scanners are periodic crawlers with blind spots: they miss session-specific or geo-targeted scripts, and a sophisticated attacker can serve a clean page to a known scanner IP while skimming real users. It is the same limitation flagged in the ISACA analysis that cside cites. The critique is fair against basic periodic crawlers. It does not describe Reflectiz.

Reflectiz is continuous synthetic monitoring, not a periodic crawl. A proprietary remote browser explores each page the way a real visitor would, executing checkout and authenticated journeys, and observes runtime behavior after page load, logging JavaScript execution, form-field access, and outbound data flows for every script, including dynamically injected content, iFrame-embedded scripts, and fourth-party code loaded several vendor relationships deep. Because it baselines what each script does rather than what its file hash is, it catches a trusted script that was silently swapped at the vendor the moment its behavior deviates, the exact case where hash checks and source allowlists both pass. And when enforcement is wanted alongside detection, Reflectiz offers client-side blocking at the platform level. It delivers the coverage QSAs increasingly ask about without adding attack surface to the page.

“Monitoring must occur in real-time as the page is constructed and JavaScript is interpreted in the consumer’s browser.”
— Stuart Golding, veteran PCI DSS consultant with ~15 years advising retailers including WH Smith, Sainsbury’s, and Argos, interviewed by Reflectiz

Vendor Profiles

Reflectiz PCI Module

Architecture: fully remote and agentless. You submit payment page URLs; monitoring begins within hours. No code changes, no developer involvement, no access to payment data.

How it automates 6.4.3: continuously updated inventory of every script on payment pages, including third-party, fourth-party, and iFrame-embedded scripts. Built-in AI drafts an audit-aligned business justification for each script, which reviewers accept, edit, or override, cutting manual documentation effort by up to 90% according to Reflectiz customer data. Smart Approvals lets teams define acceptable script behaviors once; compliant updates are then auto-approved, and only true anomalies surface for human review. Bulk Approval propagates identical approvals across every site and checkout page in one action.

How it automates 11.6.1: continuous monitoring of HTTP response headers and script content, real-time alerts on deviation, timestamped evidence logs written the moment a change is detected, and automatic suspension of a changed script’s approval status pending re-review.

QSA readiness: Reflectiz has been independently assessed by Integrity360 Europe, a PCI Qualified Security Assessor Company and member of the PCI SSC Global Executive Assessor Roundtable (GEAR). Integrity360 reviewed the platform against the technical and procedural requirements of 6.4.3 and 11.6.1 and concluded that, correctly deployed within a GRC program, it can be effective in supporting compliance with both requirements, describing the approach as a materially more efficient route to compliance than manual or static-policy methods. The full assessment is available as a white paper. Reflectiz is also a Principal Participating Organization in the PCI Security Standards Council, the highest tier of industry participation, contributing directly to Technology Guidance Groups shaping the standard. The PCI Dashboard exports one-click evidence aligned with the examine, observe, and interview procedures in PCI DSS 4.0.1 guidance, plus an Aggregated Report consolidating all monitored sites into one export, and integrates with Splunk, Jira, and any SIEM or SOAR platform via REST API.

Integrity beyond file hashes: a key point in the Integrity360 assessment is how Reflectiz verifies script integrity. Hash comparison tells you a file changed, but vendors change files legitimately every day, and an attacker who compromises the vendor replaces the file with a new, valid hash. Reflectiz baselines what each script does at runtime: which DOM elements it touches, which form fields it reads, where it sends data. A trusted script that is silently swapped at the vendor and starts reaching for card data triggers an alert the moment its behavior deviates, regardless of how legitimate the file looks.

Published outcomes:

Entry point: 30-day free trial via self-serve URL submission. Available standalone or as part of Reflectiz Security Hub, which extends monitoring beyond payment pages to the full web surface.

Best fit: organizations that cannot or will not add code to payment pages, multi-brand and multi-site merchants, regulated businesses where the compliance tool itself must not touch payment data, and teams that want audit evidence QSAs have already accepted at Level 1.

c/side PCI Shield

Architecture: proxy-based; the platform sits between third-party scripts and the browser, combined with an AI analysis layer and scanning. 6.4.3: automated inventory, AI-generated justifications, three-layer script analysis (AI, hash comparison, threat intelligence). 11.6.1: continuous header logging and change alerts, with the ability to block suspicious scripts. Validation: VikingCloud conducted a technical review confirming the solution can support compliance when deployed correctly (not a formal PCI DSS certification). Entry point: publicly listed pricing from $99/month and a free self-serve account. Best fit: solo developers, smaller merchants, and agencies wanting transparent pricing and self-serve deployment, and teams comfortable routing payment page script traffic through a vendor proxy.

Feroot PaymentGuard AI

Architecture: on-page JavaScript tag plus CSP header. 6.4.3: simulated user interactions surface conditionally loaded scripts; approval workflows generate QSA-aligned justifications; behavioral baselines validate integrity over time. 11.6.1: real-time monitoring of script activity and headers with alerts to Slack, Teams, PagerDuty, and SIEM/GRC integrations. Differentiator: operational simplicity after tag deployment; claims up to 95% reduction in audit prep time. Best fit: teams wanting hands-off operations at enterprise scale and comfortable with an embedded tag on payment pages.

Jscrambler Client-Side Protection and Compliance

Architecture: hybrid; agentless scanning for fast inventory, agent-based deployment for behavioral monitoring and active blocking. 6.4.3: AI Assistant analyzes scripts and drafts justifications, reducing approval workload by up to a reported 90%. 11.6.1: real-time tamper detection with form fencing that restricts third-party access to sensitive fields. Standards depth: CTO Pedro Fortuna sits on the PCI SSC Board of Advisors; Jscrambler is a PPO. Offers a Delegated Compliance managed service. Best fit: organizations that also need first-party JavaScript obfuscation, or want the authorization workflow fully outsourced.

Source Defense Protect

Architecture: on-page tag with behavior-based isolation; scripts run in controlled environments with Redacted or Isolated modes limiting what they can access. 6.4.3: automated inventory with justification management and integrity monitoring. 11.6.1: continuous behavior-based monitoring that adapts to new threats without manual rule tuning. Standards depth: founded 2014, PPO with the PCI SSC, member of the PCI Board of Advisors, reviewed by CoalFire and VikingCloud, protects 1,000+ global brands. Best fit: enterprises prioritizing active constraint of what authorized scripts can do, not just detection.

Cloudflare Client-Side Security Advanced

Architecture: network-layer monitoring on Cloudflare’s CDN with ML and LLM-assisted detection; formerly Page Shield. Coverage: the paid Advanced add-on supports 6.4.3 and 11.6.1; the free tier does not include the monitoring, alerting, or reporting needed for compliance. Constraint: effectively limited to organizations already routing traffic through Cloudflare; adopting it otherwise means a full infrastructure migration to add PCI script monitoring. Best fit: existing Cloudflare customers who want compliance coverage bundled into infrastructure they already run.

Detection vs. Blocking: What the Standard Actually Requires

Some vendors position real-time blocking as the dividing line between “real” solutions and everything else. Read the requirements: 6.4.3 mandates authorization, integrity, and a justified inventory. 11.6.1 mandates detection of and alerting on unauthorized changes. Neither mandates blocking, and QSAs assess evidence of inventory, justification, and change detection, not blocking capability.

Blocking has real security value, and Reflectiz offers blocking capabilities at the platform level for customers who want enforcement alongside detection. But for the compliance decision, the question that determines audit outcomes is different: can the tool produce complete, timestamped, QSA-acceptable evidence, continuously, across every payment page? That is where independent assessment and published audit outcomes matter more than feature checklists. Integrity360, a PCI QSA and GEAR member, assessed Reflectiz against both requirements and judged it a materially more efficient route to compliance than manual or static-policy approaches, and across every published Reflectiz PCI case study the audit result is the same: zero observations.

The SAQ A Consideration

The January 2025 SAQ A update removed 6.4.3 and 11.6.1 for merchants that fully outsource payments via iFrames, but added a harder condition: you must confirm your site is not susceptible to script-based attacks. PCI SSC FAQ #1588 clarifies that one accepted way to confirm this is applying techniques such as those in Requirements 6.4.3 and 11.6.1. In practice, the new SAQ A demands the very monitoring it was meant to spare you. Establishing and sustaining that eligibility requires full-site script visibility, including iFrame coverage that most on-page tools cannot deliver, because their tags do not run inside hosted payment iFrames. Reflectiz monitors the entire rendered page context, including iFrame content from hosted payment providers, and Integrity360’s assessment states that correct implementation of the Reflectiz platform may help merchants meet the SAQ A script-attack eligibility criteria.

How to Choose

All six vendors can get you to compliance. The differences that decide audits are architectural: where the tool runs, what data it can access, how complete its script coverage is, and whether its evidence has already survived QSA scrutiny. In fairness, one rival genuinely leads on buyer experience: c/side is the only tool here with public per-month pricing and instant self-serve signup, which smaller teams will value.

What Verified Reviewers and Independent Sources Say

Vendor claims are one thing; third-party evidence is another. Reflectiz holds a 4.7/5 rating across 31 verified reviews on G2 in the Web Security category, and is listed independently on software directory Slashdot/SourceForge with 33 ratings. PCI DSS 6.4.3 and 11.6.1 are the single most common use case cited in those reviews. A representative sample:

“Reflectiz made our PCI DSS 4.0.1 compliance seamless, especially with requirements 6.4.3 and 11.6.1. The onboarding was incredibly fast — less than 24 hours from providing details to having a working dashboard.” — Deepak Kumar R., Head of Information Security (verified G2 review)

“We leveraged Reflectiz for their PCI 6.4.3 and 11.6.1 capabilities and have been able to keep track of all of the scripts, domains and headers on our merchant sites with ease.” — Tim G., Head of Security (verified G2 review)

“Compliance with PCI DSS v4, specifically points 6.4.3 and 11.6.1. We would not be able to pass the certification without their compliance reports.” — Alexis M., Cloud Architecture Lead (verified G2 review)

An independent PCI consultant’s view reinforces the fit for merchants weighing deployment models:

“Personally, I tend to favor solutions that are least intrusive, both in terms of cost and implementation … organizations should explore alternatives like Reflectiz.” — Stuart Golding, veteran PCI DSS consultant, interviewed by Reflectiz

Watch: PCI DSS 6.4.3 and 11.6.1 in Practice

Two Reflectiz sessions put these requirements in a real-world context — one merchant’s compliance journey, and a cross-industry panel on where accountability actually sits.

Learning from Abercrombie & Fitch: the final push to PCI DSS v4. Reflectiz CEO Idan Cohen and A&F Director of Risk Kevin Heffernan walk through how the retailer met the new payment-page script requirements (6.4.3 and 11.6.1) — the pitfalls they hit and the tips that made compliance manageable.

Beyond PCI DSS Compliance: Who Owns Payment Risk in 2026. An executive panel with the PCI Security Standards Council (Una Dillon), APEXX Global, Domino’s UK & Ireland, and Naked Wines on the accountability gap that certification alone cannot close.

Get Audit-Ready Before Your QSA Arrives

The Reflectiz PCI Module delivers continuous payment page monitoring, AI-drafted justifications, Smart Approval workflows, and one-click QSA evidence, deployed in hours with no code changes and no access to payment data.

• Start a 30-day free trial
• Explore the PCI Module
• Download the Reflectiz + Integrity360 PCI Compliance Solution Assessment