PCI DSS v4.0 introduced two requirements that apply to scripts running in the consumer's browser on payment pages. Cloudflare's client-side security helps you meet both.
Requirement 6.4.3 applies to all scripts that a payment page loads into the consumer's browser, regardless of whether those scripts are first-party or third-party.
| Control objective | What it requires | How client-side security addresses it |
|---|---|---|
| Script inventory | A documented inventory of all scripts loaded to a payment page | The Monitor resources view lists every script loaded on monitored pages, including third-party scripts |
| Business justification | A written justification (business or technical) for each script | You can review scripts in the dashboard and export the inventory for annotation to document each script's purpose |
| Authorization method | A method to confirm that each script is authorized | Content security rules block or report scripts that are not explicitly allowed |
Requirement 11.6.1 requires a mechanism that detects unauthorized modifications to your payment pages and their security headers.
| Control objective | What it requires | How client-side security addresses it |
|---|---|---|
| Tamper detection | Detect unauthorized changes to HTTP security headers and payment page content | Alerts fire when scripts, connections, or cookies on a monitored payment page change. Cloudflare's detection runs continuously — no manual scheduling is required. Refer to the PCI DSS v4.0 Evaluation ↗ whitepaper for the full requirement mapping |
- Follow Get started with client-side security to enable monitoring on your payment pages.
- Use Monitor resources to review the full inventory of scripts and connections detected on those pages.
- Classify and approve each script to build your authorized inventory for requirement 6.4.3.
- Configure alerts to receive notifications when unauthorized changes are detected (requirement 11.6.1).
- Deploy rules to enforce your script policy and block unauthorized scripts.
For a detailed mapping of client-side security features to PCI DSS v4.0 controls, refer to the PCI DSS v4.0 Evaluation ↗ whitepaper.
- PCI DSS compliance — configure TLS version and cipher suites to meet PCI DSS requirement 4.2.1, and understand how Cloudflare interacts with PCI ASV scans
- Cloudflare Trust Hub ↗ — obtain Cloudflare's Attestation of Compliance (AOC) for your QSA