Change-and-Tamper Detection Mechanism
PCIComplianceHubLast updated
A control that watches a payment page as the consumer's browser actually receives it and alerts on unauthorized modification to its HTTP headers or its contents. PCI DSS Requirement 11.6.1 requires such a mechanism on payment pages, evaluated at least weekly or at a frequency justified by a targeted risk analysis. It exists to catch client-side skimming, where an attacker alters a page or an included script to harvest card data before it is ever submitted to the merchant. This was future-dated at publication and became mandatory on 31 March 2025.
Applies to. Every entity with a payment page in its assessment scope: merchants serving or embedding one, and the provider serving an embedded form.
Example. A monitor fetches the checkout page in a browser at least weekly, records the response headers and a hash of each script as received, and alerts when a header disappears or a script's content differs from the last run. The alerts, and what was done about them, are what an assessor examines under 11.6.1.a.
Limits. Weekly is the ceiling unless a targeted risk analysis under 12.3.1 defines a longer interval; that analysis has to exist and be reviewed at least every 12 months. The mechanism is asked to alert on unauthorised modification of security-impacting HTTP headers and script contents, including indicators of compromise; it is not asked to block, and blocking without alerting does not meet it. A crawler sees the page it is served, which may differ from what a customer elsewhere is served, so the guidance lists CSP violation reports, synthetic browser monitoring, tamper-detection script in the page, and reverse proxies as techniques that can be combined.
Related. Baseline (Change Detection), Hash Drift, Payment Page, Content Security Policy (CSP), Targeted Risk Analysis (TRA), E-Skimming, File Integrity Monitoring
Sources. PCI DSS v4.0.1 (June 2024)