Is your checkout still the page you approved?
Card-skimming attacks usually arrive as one extra third-party script on a payment page. Approve the scripts your page should load, then check again whenever you like and see exactly what changed.
Check a payment page
A few passive page requests. No signup, and nothing about the page is stored on our servers.
- 1
Check
One passive look at your payment page. Nothing is exploited and no JavaScript is run.
- 2
Approve
Save the scripts and frames you expect. The baseline stays in your browser.
- 3
Check again
Anything outside the baseline is flagged, with the fixes and a policy that blocks it.
Pages you watch
Usually 10 to 40 seconds. Keep this tab open.
- TLS and HSTS
- Content-Security-Policy
- Security headers
- Scripts and frames
- Cookies
- Payment forms
Fix these first
Scripts and frames on this checkout
Starter Content-Security-Policy
Pin scripts with an integrity attribute
These tags pin each script to the exact content fetched in this check, so a browser refuses it if the file is ever altered. Only use them for versioned script addresses you have reviewed: pinning a file that changes on every release will break your page.
Missing security headers
Scan history
Evidence pack
A standalone report of what this check observed. It is evidence of an observation, not a compliance certificate.
What this does not tell you
Check on a schedule
securescan-check.sh
.github/workflows/payment-check.yml
Check while this tab is open
SecureScan keeps nothing on its servers, so it cannot check by itself when your browser is closed. While this tab stays open it can check this page again for you and tell you when something changes. For checks that run around the clock, use the schedule above.
Move your baselines
Baselines live in this browser. Export them to keep a copy or to open them somewhere else.