What does the checkout walk do to my store?

While your tested checkout path is on, each check adds one item to a cart on your store and follows the path a shopper takes to pay: on WooCommerce to your payment page, on Shopify to your cart page, which is where its checkout leaves your store. No payment details are ever entered and nobody completes the order. The visit may show in your own analytics. We ask your approval before the first walk, and you can turn the path off in Settings.

Is this the CyberShield Checkout Script Monitor plugin?

No, and the two work together. The plugin is free and runs inside WordPress, listing the scripts your checkout loads. Store Health reads your store from outside on a schedule, with no plugin, and compares each check with the previous one.

Do you install anything on my store?

No. Nothing goes on your payment page. Under PCI DSS 6.4.3, a vendor's tag on that page is one more script you must inventory and authorise.

Store Health for WooCommerce

On WooCommerce, the checkout is yours. So is every script that runs on it.

Your checkout is built from plugins, a theme and a payment gateway that each update on their own schedule. Whether your gateway takes the card on your own page or on its hosted one, the path your shopper walks to get there is yours. Store Health walks that path from outside on every check, reads what runs on it, and tells you which changes could lead to stolen card details, leaked customer data or a privacy complaint.

Check a page of your store, free See the plans

Paste your URL. About 20 seconds. No account, no card. Nothing to install.

What the checkout walk reads on WooCommerce

We walk from your product page to your payment page, the last page of your checkout before your gateway takes the card, and read what runs there. We never submit payment or place an order.

Once your checkout path passes its test, every check walks it, on Free and Pro. We ask your approval before the first walk, and you can turn it off.

A dated record for your SAQ A review

Store Health Pro keeps a dated record of your checkout path, 90 days back, for your SAQ A review. Whether SAQ A, SAQ A-EP or SAQ D applies depends on where your shopper types card details and how your gateway handles them; our free SAQ selector asks.

What goes wrong on WooCommerce, and what we read for it

The same six areas as on every platform, in the order they matter most here. Each check is compared with your previous check, and each change is ranked Should check, Good to check or Recorded only.

First on WooCommerce

Stolen card details

A plugin update that adds a script to your payment page, or a checkout that sends your shopper to a payment page you did not choose. We walk the path and read every script on it.

Checkout scripts. Each script that runs where shoppers pay or start to pay, and whether we can name where it comes from.
Tamper monitoring. Whether a tool watches your payment page and reports changes that you did not make.

Read on every check, on every plan, once your checkout path has passed its test.

We watch for

Leaked customer data

WordPress, its plugins and its theme name their versions on your pages. When a published advisory names one of them, your next check says so. With a verified domain, it names the software and the fix.

Security settings. Whether your pages tell browsers which scripts may run and which sites may embed them, and whether your login cookies can only travel over an encrypted connection.
Connection encryption. Whether your store accepts only modern encryption, with a valid certificate.
Software updates. Whether the software your store's pages name, WordPress, its plugins and themes, and JavaScript libraries, has a published security vulnerability.

Read on every check, on every plan.

We watch for

A privacy complaint

A consent plugin set up wrong, or a tag added outside it. We read what fires before the banner is answered, on the pages shoppers land on.

Consent before tracking. Whether trackers, such as ad pixels and session recorders, run before shoppers agree to them.

Read on every check, on every plan.

From the blog, for WooCommerce stores

How to See Every Script Running on Your WooCommerce Checkout

WordPress has no screen listing the scripts on your checkout. Here's how to get a script inventory, what PCI 6.4.3 asks for, and a free plugin that does it.

AI-Powered Card Skimmers: How a Rogue Script Hides on a WooCommerce Checkout

Modern card skimmers use AI to mutate their code and impersonate legitimate plugins. Here's how they hide on WooCommerce checkouts, and what store owners can do to find them.

"Vibe-Coded" Plugins and the WooCommerce Supply-Chain Risk in 2026

A CVSS 9.8 backdoor in a plugin with 200,000+ installs showed what happens when AI-generated code ships without security review. Here's what WooCommerce store owners need to know.

Your Cookie Banner Probably Isn't Blocking Anything. Here's How to Check in Five Minutes

Most cookie banners record a shopper's choice without holding trackers back until it is made. A plain-English way to check what your own store sends before anyone answers.

Questions WooCommerce merchants ask

It depends on where your shopper types card details and how your gateway handles them. If your gateway's hosted page or iframe takes them, SAQ A usually appears to apply. If the card fields are on your own page, SAQ A-EP or SAQ D, depending on how the data reaches your gateway. Our free SAQ selector asks the questions. It gives a first impression, not an attestation.

Run it on your WooCommerce store

About 20 seconds, no account. You get the list of what we found.

Check a page of your store, free See the plans

CyberShield Studio monitors and reports; it does not certify compliance or replace a QSA, ASV, or legal counsel.