Free bounded evidence check

Build reviewable payment-page change evidence for PCI DSS 11.6.1

Requirement 11.6.1 calls for a mechanism that detects unauthorized changes to payment-page content and security-impacting HTTP headers and alerts personnel. Tessera re-evaluates every 72 hours, hash-chains the observations, and exposes private status for your monitoring system to poll; it does not itself notify personnel. Stale evidence is reported separately from chain integrity. This is supporting evidence, not a compliance determination or a replacement for qualified review. Start with a page you are authorized to inspect:

Start the free check

No account
No card data requested
Raw scan results are not stored
Scope limits shown in the result

Run the check

Authorized payment-page URL

Where are card fields rendered? Required

Fields on my pageIn fields served by my own systems, not inside a processor-owned form Processor iframe on my pageInside a processor-owned form or iframe embedded in my page Redirected to processorAfter a redirect, or on a fully outsourced processor page

Not sure which describes your flow? Read the embedded-form versus redirect guide before choosing.

Authorized script domains (optional)

Supply your 6.4.3 inventory to identify observed scripts not on it. Leave blank to inventory scripts without deciding authorization.

Use only a page or domain you own or are authorized to inspect. Do not enter credentials, card data, or private source.

Free CI integration

Catch payment-page script changes in GitHub Actions

The public MIT-licensed Action is published from the operator's personal ntoledo319 GitHub account. Point it at an authorized public URL or a deliberately generated workspace-relative HTML file, provide the same payment-page scope and authorized-domain list, and it writes the bounded findings to the job summary. Choose high, medium, low, or never as the failure threshold.

- uses: ntoledo319/pci-payment-page-check@v1
  with:
    url: https://yourstore.com/checkout
    allowed-domains: js.stripe.com
    fail-on: high
    payment-page-scope: direct

It inventories served HTML. It does not inspect headers, fetch referenced script bodies, execute JavaScript, determine authorization, or determine PCI DSS compliance.

Inspect before buying

Exact price. Representative deliverable.

The samples are synthetic and contain the same evidence sections as delivery. A checkout link appears in a result only when the matching product and its fulfillment path are healthy.

$99 / month

PCI DSS 11.6.1 evidence ledger

A 72-hour cadence, hash-chained history, and private status for your alerting system to poll; Tessera does not notify personnel.

Preview the synthetic 11.6.1 ledger

$299 once

PCI DSS 6.4.3 remediation pack

Finding-by-finding observation, risk, fix, and validation guidance.

Preview the synthetic 6.4.3 pack

From free observation to reviewable evidence

Check an authorized asset. The free result names bounded machine-observable facts and its blind spots.
Inspect the matching sample. See the remediation or ledger sections before deciding whether the paid artifact fits your work.
Checkout only when delivery is ready. Billing, delivery, refunds, retention, and required scheduled jobs are rechecked before the first-party checkout hop redirects to Polar.

Buyer protections

Named operatorIndependent software from Toledo Technologies LLC.

Merchant of recordPolar handles payment and receipts.

Delivery protectionEligible paid orders automatically refund if no complete initial delivery arrives within 48 hours; a ledger subscription's renewal is also stopped.

Questions: qi@toledotechnologies.com. Read the enforced refund policy.