Your store changes every week. We check what those changes did to its security.
An app updates itself. Your agency adds a tag. A theme gets a new version. A vendor's script gets hacked. Every week our AI agent reads your store from the outside, the way an attacker would, and compares it with last week — looking for the changes that lead to stolen card details, leaked customer data, or a privacy complaint. Then our security experts weigh in on which changes matter to your store, and which you can ignore.
Paste your URL. About 20 seconds. No account, no card.
Built by cybersecurity and PCI experts · CISSP · PCIP · 30+ years · Any platform · Nothing to install
yourstore.com · weekly security check
3 changes
Security grade
Your store got less safe this week
Two of the three changes below did it. You made neither.
A new script appeared on Tuesday
Your reviews app pulled it in after an update. Nobody on your side changed anything. It runs on every page, including checkout.
A tracker now fires before visitors answer your cookie banner
On the homepage and product pages. Last week it waited. This is the kind of change privacy demand letters cite.
Checkout still hands off to the same payment page
Same provider, same scripts as the version you marked as normal. 14 days unchanged.
Illustrative report. Free tells you what changed; paid adds whether it matters. A grade describes what we observed, not a prediction about your store.
91.6%
of monitored payment pages served a script they had never served before — inside two weeks.
48%
of scripts were loaded by another script, not by the page's own HTML.
8
median new scripts appearing per page over the same two weeks.
Source: c/side, Client-Side Attack Report, Q3 2026, a 14-day window ending 22 July 2026. Their sample is payment pages they monitor for their own customers, not a census of the web — read it as a strong signal rather than a universal rate. We cite a competitor's number because it is the best public measurement of the thing we are describing.
That 48% is why a one-time audit does not hold. Half the scripts on a payment page were not put there by the page. They were pulled in by another script — which can change what it pulls tomorrow, without anyone editing anything.
Is your store one of them? Find out in about 20 seconds.
The Webpage Security Checker reads any page of your store from the outside and shows you what is running and where the weak spots are. No account, no card. Want to know which services start collecting before your cookie banner is answered? The Website Tracking Checker does that, free, on the same terms.
A check shows you today. The question is next week. App updates, theme edits and new agency work change your store — usually without anyone telling you. Prove the domain is yours and we keep checking, weekly, free.
Two parts of your store. One way of looking at them.
The pages your shoppers browse, and the page that takes their card. Same engine, same weekly report — because both draw the same kind of trouble from the same blind spot: nobody knows what is running there this week.
- Every script and service your pages load, and who put it there
- Which services start collecting before your cookie banner is answered
- Whether the security settings your store should have are switched on, and stay on
- Whether a fix held, or the behaviour came back
Every platform — Shopify, WooCommerce, Magento, custom.
- We walk the path a real shopper takes to pay
- Every script observed on that path, week over week
- Where your checkout normally hands off — and an alert when that changes
- A kept record across your assessment year
On Shopify or BigCommerce? Their vault. Your doorway. We watch the doorway. The payment form sits inside their PCI-validated environment — but the path your shopper takes to reach it, and the destination they are handed to, are still yours.
Nothing goes on your payment page
We watch from outside, so there is no script tag to add and no new vendor on the page that takes card details. That last one matters more than it sounds: under PCI DSS 6.4.3, a security vendor's own tag lands in your scope, and you are the one who has to inventory and authorise it.
AI does the legwork. Experts weigh in. You make the calls.
A store changes constantly and most of those changes are nothing. Raw output would bury you in them.
See how the weekly check works, in full.
Something already landed, and there is a date on it
A processor notice, a privacy demand letter, a remediation backlog with a deadline. A subscription is not what you need first. Bounded engagements with a certified security and PCI professional — we scope you down, do the work, and produce the technical record.
We monitor and report; we do not block attacks, and we do not certify compliance. We are not a QSA or an ASV, and nothing we run satisfies PCI DSS Requirement 11.3.2. Your self-assessment, risk decisions and attestation remain your own.
Questions you probably have
What we check, what happens after the free check, and the letters a store can draw — stolen card details, leaked customer data, a privacy complaint. Plain English.
We check your online store from the outside, every week, and tell you what changed. Our AI agent reads your pages the way an attacker or a privacy compliance scanner would — every script, every service, every tracker, and the path your shopper takes to pay — and compares it with last week. Then our security experts weigh in on which changes could mean stolen card details, leaked customer data or a privacy complaint, and which you can ignore. Two products on one platform: Storefront covers the pages your shoppers browse; Checkout covers the page that takes their card. Each has a free plan, nothing gets installed on your site, and it works on any platform.
Still have a question? Reach out via the contact form and we'll respond within a business day.