Why payment page script monitoring matters
Payment forms often depend on analytics, tag managers, consent tools, fraud services and payment providers. Every permitted script expands the browser-side trust boundary. An unexpected source or changed inline script deserves review even when the application server itself has not changed.
What evidence does a payment page monitor produce?
DygDog records the page URL, classification, observation time, script count, third-party count, aggregate fingerprint, CSP summary and SRI summary. Snapshot data is bounded and tenant-scoped rather than storing entire page bodies.
How should teams respond to script drift?
Compare the observation with approved releases and vendor changes. Remove unknown code, confirm expected third-party changes, review checkout telemetry and follow your incident-response process when a change cannot be explained. A drift alert is a triage signal, not proof that card data was stolen.
What DygDog checks
Checkout classification
Uses URL and visible HTML signals to identify likely checkout or payment pages.
Source inventory
Normalises relative and absolute script URLs and identifies third-party hosts.
Inline fingerprints
Hashes sanitised inline-script content so material changes can be compared without retaining the full code.
External inventory drift
Uses a query-sensitive fingerprint to detect version changes without retaining query values, and compares integrity metadata. Remote script bodies are not downloaded or hashed.
SRI review
Checks integrity syntax and the crossorigin relationship for eligible cross-origin resources.
CSP review
Reports absent or permissive script controls observed in response headers.
Drift report
Lists added, removed and changed inventory entries against the prior baseline.
Coverage limits to understand
- JavaScript inserted only after runtime execution may not appear in fetched HTML.
- Personalised or geographically varied pages can create legitimate changes that require human review.
- Monitoring supports a control process; it does not replace vendor approval or incident response.
Frequently asked questions
Can DygDog monitor checkout pages continuously?
DygDog compares scheduled or manually triggered scans. It is continuous in the sense of repeat monitoring, not an in-browser real-time sensor.
Does it store full payment-page source code?
No. The module stores bounded, sanitised script metadata and fingerprints rather than full page bodies or payment data.
Can it detect Google Tag Manager changes?
It can observe changes in script elements present in fetched HTML. It does not execute a tag-manager container, so tags injected only at runtime are outside this module’s coverage.