CheckoutScripts6.4.3 · 11.6

How the scan works, and what it misses

One HTTP request, no browser. CheckoutScripts fetches the address you give it, follows redirects, reads at most four megabytes of HTML and stops there, without running a line of the JavaScript it finds. Everything on the result page comes out of that single document, which is both why the scan takes under two seconds and why the four gaps listed further down exist at all.

What counts as a third-party host

Every absolute http or https address in the delivered HTML whose registrable domain differs from the domain of the page itself. Addresses in script and iframe tags are additionally marked as executing, because those are the ones the browser will run. Standards namespaces such as w3.org are ignored, since they are markup declarations rather than requests.

The fingerprint

Sixteen characters. That is the whole mechanism.

4f1c8ad9e2b6730a
sha256(sorted hosts + "\n#exec\n" + sorted executing hosts)[0:16]

The sorted list of hosts, plus the sorted list of executing hosts, hashed with SHA-256 and cut to sixteen characters. Two reads of an unchanged page give the same value. A new tag, a removed tag or a renamed vendor host changes it. Text, prices and stock levels do not, which is the point: requirement 11.6 asks about the script surface, not about the page content.

The reference scan

On 30 August 2026 we took a hand-assembled list of 305 United States online stores, requested /cart on each and fell back to the home page where that path did not exist. 187 of them answered with a usable page; the rest timed out, refused the request or returned a bot challenge. From those 187 pages we kept every third-party host that appeared on at least two different stores, which gave the 448 entries in the directory.

Vendor descriptions were then taken from each vendor's own website: we fetched the registrable domain and read its title and meta description. Where a vendor site returned nothing, the directory says so instead of guessing. That is why 165 entries carry no description.

Measured on those 187 pages: the median page carried 23 third-party hosts, 113 carried twenty or more, the largest carried 107, 101 ran a Google Tag Manager container and 6 ran more than one.

23
median hosts
107
largest page
101
ran a container

Four things this method cannot see

01
Tags a container fires. A tag manager loads its children after the HTML arrives. The container is visible, its children are not. On the 101 stores that run one, the real list is longer than the one we print.
02
Scripts added by other scripts. Same mechanism, without a container: a vendor library that loads a second library is invisible to a single fetch.
03
The real checkout behind a login. A cart page is publicly reachable; the payment step usually is not. The cart is the closest public proxy, and on most platforms it carries the same tags.
04
Whether a file changed at an unchanged address. The fingerprint covers which hosts are present, not the contents of the files they serve. Per-file integrity hashes are on the roadmap and are marked planned there.

All four are reasons to treat the output as a floor for your inventory rather than a finished document. A tool that hid them would be more comfortable and less useful.

What this is not

Not an approved scanning vendor scan, not a qualified assessor opinion, and not a statement that your site is or is not compliant. CheckoutScripts produces a list. What you write next to each line, and whether your acquirer accepts it, is between you and them, and no tool that has never seen your cardholder data environment can honestly claim otherwise.

Scan a page · Browse the directory