Third-party script monitoring, including the scripts you never added

To monitor fourth-party scripts, watch the browser, not your vendor list. Record every script that runs in real sessions, with the script that loaded it, and get an alert when what it does changes. Here's why. You approve one vendor. It loads two more, and one of those loads another. All of them run with the same privileges as your own code. A third party is a vendor whose script you added. A fourth party is a script that vendor loaded. You have no contract with them, often no visibility, and full exposure. So approving a vendor is not approving a script. On payment pages, PCI DSS 6.4.3 applies to every script that executes, whoever added it. Tag managers are the noisiest source we see. An attacker doesn't need your container: they can inject through another one loaded as a sub-request, so the origin still reads as Google. Judge it by what it loaded, not its name. So lock the container down: MFA on every account, publish rights for a few named people, a second person to approve each publish, and limits on custom HTML tags. For every script in the chain, monitor four things: identity and load chain, payload integrity, runtime behaviour, and change over time. Most tools stop at the first. Integrity is where allowlists fail. A vendor can change what a file contains without changing its address, and an origin allowlist won't notice. Pin approval to the payload, not the URL. Behaviour is what a script does once it runs: what it touches on the page, whether it reads form fields, and where it sends data. An analytics script can read your payment form as easily as your checkout code can. The script that behaved for six months and changed last Tuesday is the interesting case. So review only what changed: new scripts, new destinations, changed code. About ten minutes a week. Script Monitoring does this from one tag, reporting every script in every session. On Pro, it also draws the full vendor load chain. Script Monitoring is free for 1,000 page views a month. Pro, with the load chain and guardrails, starts at $99 a month. Start for free at scriptmonitoring.com.

The main risk of third-party scripts is that every one of them runs with the same access as your own code. It can read the page, read what visitors type, and send data anywhere, and the browser can't tell it apart from your checkout. We make Script Monitoring. It records every script that runs on your pages, in every real session, from one tag. There's no privilege boundary on a page. Your checkout code can read the card field. So can the analytics tag. So can the script that analytics tag loaded. And the scripts on your page are a tree, not a list. You approve a vendor, and the vendor loads two more. The last script in the chain is often a company you've never heard of. Approving a vendor isn't approving a script. Then there's shadow code: scripts nobody on the current team approved. A campaign tag nobody removed. A tag added by someone who has left. A plugin that ships its own scripts. So what can go wrong? Card skimming. Credential harvesting on a login form. Data leaking to third parties, usually a misconfiguration. Malicious redirects for a slice of traffic. Cryptojacking. And overlays drawn over the real interface. Your existing tools don't see it. A WAF, a SIEM and EDR all watch infrastructure you own. A skimmer posts the card from the browser straight to the attacker, so none of that traffic reaches you. And it's a moving target. The same URL can serve different code by browser, device or location. So monitor four things for every script. Where it loaded from and what loaded it. Whether its contents match what you approved. What it does, like reading form fields or sending data. And when any of that changed. Build the inventory from real sessions, not your tag manager. Delete what nobody can justify. Then review what changed, each week. On payment pages, PCI DSS 6.4.3 & 11.6.1 require this since 2025. Script Monitoring is free for 1,000 page views a month, with unlimited scripts and vendors. Pro starts at $99 a month, with a 14-day trial. Start for free at scriptmonitoring.com.