Defence
-
Content Security Policy for a checkout page: a working setup
A CSP lets the browser refuse to send card data anywhere you did not approve. How to deploy one on a payment page without breaking it, starting in…
-
Subresource Integrity: pinning the scripts you cannot control
SRI records a script’s exact hash so the browser refuses it if it changes. The defence against a trusted supplier serving altered code.
-
Hosted payment fields: the cheapest way to remove skimming risk
Move the card inputs into a frame served by your payment provider and a skimmer on your page cannot read them. Usually a configuration change, and free.