[WordPress] 外掛分享： Dragon Checkout Guard – PCI DSS Compliance & Card Skimming Detection for WooCommerce

內容簡介

Dragon Checkout Guard 是一款專為 WooCommerce 設計的外掛，旨在協助商家達成 PCI DSS 合規性，並偵測卡片竊取行為。透過監控支付頁面的腳本和安全標頭，確保商店免受攻擊，保護顧客資料安全。

【主要功能】
• 腳本清單記錄：監控支付頁面所有腳本的來源與變更
• 授權工作流程：為每個腳本記錄擁有者及用途
• 每週篡改檢查：定期掃描並檢查腳本變更
• 電子郵件警報：變更時自動發送通知
• 輸出證據記錄：可供審核使用的證據資料

外掛標籤

開發者團隊

原文外掛簡介

Nearly every WooCommerce store embeds its gateway’s card fields in an iframe:
Stripe, WooPayments, PayPal, Braintree or Adyen. Since 31 March 2025, SAQ A
carries an eligibility criterion that such a merchant has confirmed its site is
not susceptible to attacks from scripts, and PCI SSC FAQ 1588 (February 2025)
sets out the two ways to confirm it: apply techniques such as those in
requirements 6.4.3 and 11.6.1 to your own page, or hold written confirmation
from the PCI DSS validated provider that its embedded form includes script
attack protections when implemented to the provider’s instructions. That second
route is not available from every provider, which leaves the first: an inventory
of the scripts on the page around the iframe, a justification for each one, and
a check that they have not changed.
The iframe is the provider’s. The page it sits in is yours, and a script
injected into that page is what e-skimming (the Magecart style of attack) uses
to read a shopper’s details before the iframe ever sees them. Dragon Checkout
Guard is the record of what runs on that page.
It records, on your own WooCommerce checkout, order-pay, add-payment-method and
(optionally) cart pages:

an inventory of the scripts the page loads through