Payment pages are a target; it’s one of the most well-documented attack vectors in web security. Attackers who can’t break through a platform’s defenses will often try a different approach: tampering with the scripts that run on a page after it loads. If they can modify or inject a script on a payment form, they can silently capture card numbers, expiration dates, and CVVs before that data ever reaches a payment processor.
This type of attack — sometimes called Magecart or web skimming — has affected some of the largest organizations in the world. And the reason it persists is that it’s hard to catch. A script change might be invisible to the form owner, the respondent, and even standard security monitoring, because the form still works exactly as expected.
This is why we’re introducing Script Integrity Verification for payment forms.
What script integrity verification does
Script Integrity Verification monitors the custom scripts loaded on your payment pages and alerts you the moment something changes. Using a technique called Subresource Integrity (SRI), FormAssembly records a fingerprint of each script at the point it’s verified. If a script’s contents change — for any reason — you’ll receive an email notification right away.
From there, you have five days to review the change and confirm it’s legitimate. If it is, you verify it and monitoring resumes as normal. If you don’t recognize the change, you can investigate or remove the script before it does any harm. If no action is taken within five days, the script is automatically blocked from running on your payment page.
Why we’re building script integrity verification now
PCI DSS v4.0.1 sets a clear expectation: organizations that collect payment card data must monitor scripts on their payment pages for unauthorized modifications. That requirement reflects what the security community has known for years — you can’t protect data you’re not actively watching.
FormAssembly already invests heavily in infrastructure security, compliance certifications, and data governance. Script Integrity Verification extends that commitment to the client-side layer of your payment forms, where third-party scripts often operate outside a platform’s direct control.
We’re building this because we recognize manual audits are difficult for customers to perform at scale. The people using FormAssembly to collect payments are focused on running their organizations, not monitoring script hashes. This feature makes that protection automatic, and makes sure that if something unexpected happens, you know about it fast enough to act.
What this means for you
If you don’t use custom scripts on your payment forms, you won’t notice a thing. If you do, you’ll start receiving notifications when those scripts change — which is exactly the visibility you should have.
When a notification lands in your inbox, it’s a prompt to do one simple thing: confirm that the change was expected. Most of the time, it will be — a script provider pushed an update, or your team modified a custom function. Occasionally, it won’t be. In those cases, the five-day window gives you time to investigate before anything is blocked.
Security tools are most valuable when they get out of your way unless something actually needs your attention. That’s what we’ve built here.
If you’re looking for a secure solution to automate your data collection and payment processes, schedule a call with a FormAssembly expert to discuss your organization’s needs.
