PCI DSS 11.6.1 solution for payment-page change detection
Weekly change detection as the customer browser received the page — scripts and security headers, at least every seven days. Last checked against PCI DSS v4.0.1 in September 2026.
PCI DSS v4.0.1 11.6.1 is that weekly watch, not a yearly review. Manifest records scripts and headers as delivered, at least every seven days, and alerts someone when they change. A yearly penetration test is not that. Tagnovo is not a QSA and does not certify compliance.
What it says
You need something that detects unauthorised change to your payment pages — both the scripts running on them and the security headers they send — and alerts someone when it happens. It has to run at least every seven days.
The wording matters in one specific way: it is about the page as the customer's browser received it. Not as it exists in your theme, not as your CDN has it cached. What actually arrived.
Does it apply to you
Your acquiring bank decides, and it depends where your card fields live.
| Where card details are entered | Typically |
|---|---|
| A page on your own domain | applies |
| An embedded frame from your gateway | often applies to the page hosting it |
| A full redirect to the gateway | usually reduced |
We are not a qualified assessor and this is not advice. Ask your acquirer which questionnaire they expect from you — that single answer settles it.
What counts as evidence
Assessors are looking for a record, not a screenshot of a dashboard.
- A baseline
- What the page was expected to contain, and when that was agreed
- Regular checks
- Timestamped, at least weekly, with what was observed each time
- Change records
- What changed, when, and who looked at it
- Alerts that reached someone
- Detection nobody receives is not detection
- Headers too
- Not only scripts — the security headers as delivered
The mistake nearly everyone makes
Checking the page from a server. Card-skimming scripts test whether the browser is being driven by automation and stay dormant when it is, so a scanner is served the clean version of a compromised page and reports it as fine. If your monitoring only crawls, it will pass a breached site.
This is also why an annual penetration test does not satisfy 11.6.1. The requirement is continuous by construction, because a script can be swapped and swapped back inside a week.
Questions people ask
Is Tagnovo a PCI DSS 11.6.1 solution?
Manifest watches payment-page scripts and security headers as the customer browser received them, at least weekly, and alerts someone when they change. Tagnovo is not a QSA and does not certify compliance.
Can a yearly penetration test satisfy 11.6.1?
No. The requirement is continuous by construction. A script can be swapped and swapped back inside a week. An annual test finds a hole that was there on the day.
Related
PCI DSS 6.4.3 solution
The authorized inventory itself, and the written reason each script is there.
SAQ A or SAQ A-EP
The scoping question underneath all of this, explained without jargon.
What a scan covers
What a scan loads and reports, and what it cannot see.
See what is running on the shop
Free, no account. Home, a collection, a product, and the cart. Checkout is not loaded: an empty cart is sent to the basket.