PCI DSS 4.0.1, the current version of the Payment Card Industry Data Security Standard, made many previously-optional requirements mandatory after March 31, 2025 — which means 2026 is the year most dealerships accepting card payments online actually feel the operational impact of changes that were announced well before this deadline but easy to defer. If your dealership site accepts credit or debit card payments (financing deposits, service payments, parts orders), this standard applies to you directly.
The New Requirement Dealers Are Most Likely to Miss
Requirement 6.4.3 specifically governs management of scripts loaded and executed on the payment page within the consumer’s browser — a requirement made mandatory after March 31, 2025, and one that’s easy to overlook precisely because it’s about client-side script behavior, not server-side security in the traditional sense. If your payment page loads third-party scripts (analytics, chat widgets, marketing pixels, anything beyond the payment processor’s own code) without proper inventory and authorization, that’s now a direct compliance gap, not just a general best practice being skipped.
Why This Specific Requirement Exists
Client-side payment page attacks (commonly called “digital skimming” or Magecart-style attacks) work by injecting malicious JavaScript into the checkout page itself, silently capturing card data as the customer types it — entirely bypassing server-side security since the theft happens in the browser, before the data is even submitted. Requirement 6.4.3’s focus on managing exactly which scripts run on the payment page is a direct response to this specific, real attack pattern.
What Increased Focus Actually Means in Practice
| Area | What’s now expected |
|---|---|
| Payment page scripts | An authorized inventory of every script running on the payment page, with justification for each, and a method to detect unauthorized additions |
| Third-party/vendor oversight | Your payment processor, gateway, POS provider, and ecommerce platform all factor into your compliance and risk posture — not just your own code |
| Ongoing monitoring | Continuous verification, not a one-time compliance checklist completed and forgotten |
What to Actually Do
- Inventory every script currently loading on your dealership’s payment pages — financing deposit forms, service payment pages, parts checkout — and confirm each one is genuinely necessary and authorized.
- Remove or relocate any non-essential third-party scripts away from the actual payment page specifically, even if they’re legitimate (analytics, marketing pixels) — the fewer scripts with access to that page, the smaller your compliance and attack surface.
- Engage a PCI Qualified Security Assessor if you haven’t already, specifically to confirm your current setup meets the now-mandatory 4.0.1 requirements rather than assuming your prior compliance status still holds.
- Review vendor contracts and oversight for every party touching your payment flow — processor, gateway, ecommerce platform — since their compliance posture now factors directly into yours.
This is a real compliance and legal matter, not just a technical best practice — we’d recommend pairing this review with legal counsel or a QSA rather than treating it as a self-audit. Want your dealership’s payment page reviewed for script hygiene as a starting point? Get in touch.
Frequently Asked Questions
Does PCI DSS 4.0.1 apply if we use a third-party payment processor’s hosted checkout?
Using a hosted/redirected checkout can reduce your direct compliance scope, but doesn’t eliminate the need to understand your specific setup — this is exactly the kind of determination worth confirming with a QSA rather than assuming.
What’s the real risk of not complying with Requirement 6.4.3 specifically?
Beyond compliance penalties, an unmanaged payment page script inventory leaves you more exposed to digital skimming attacks that steal card data directly from the browser — a real security risk independent of the compliance framework itself.
Is this a one-time setup task or ongoing?
Ongoing — PCI DSS 4.0.1’s emphasis on continuous monitoring rather than periodic checklist completion reflects that payment page scripts and vendor relationships can change, requiring regular re-verification, not a single pass.
Featured image: original illustration.