Your store changes every week. We check what those changes did to its security.
An app updates itself. Your agency adds a tag. A theme gets a new version. A vendor's script gets hacked. Every week our AI agent reads your store from the outside, the way an attacker would, grades what a shopper's browser can see, and compares it with your previous check, looking for the changes that lead to stolen card details, leaked customer data, or a privacy complaint. Each change is ranked Should check, Good to check or Recorded only, by rules our security experts built. You decide what to do.
Paste your URL. About 20 seconds. No account, no card.
Built by cybersecurity and PCI experts · CISSP · PCIP · 30+ years · Any platform · Nothing to install
yourstore.com · Store Health
Example
- Where you stand
- Five areas holding. Consent before tracking fell from B to D.
- What changed
- 2 changes: 1 Should check, 1 Good to check. You made neither.
- Compared with
- Your store four weeks ago (dashed)
A tracker now fires before visitors answer your cookie banner
Should check
On the homepage and product pages. Four weeks ago it waited. This is the kind of change privacy demand letters cite.
A new script appeared on Tuesday
Good to check
Your reviews app pulled it in after an update. Nobody on your side changed anything. It runs on every page, including checkout.
Checkout still hands off to the same payment page
Same provider, same scripts as four weeks ago. Nothing to do.
Illustrative example. Free tells you what changed. Pro tells you why it matters and what to look at first, and, with a verified domain, emails you the day a check finds it. A grade describes what we observed, not a prediction about your store.
91.6%
of monitored payment pages served a script they had never served before — inside two weeks.
48%
of scripts were loaded by another script, not by the page's own HTML.
8
median new scripts appearing per page over the same two weeks.
Source: c/side, Client-Side Attack Report, Q3 2026, a 14-day window ending 22 July 2026. Their sample is payment pages they monitor for their own customers, not a census of the web — read it as a strong signal rather than a universal rate. We cite a competitor's number because it is the best public measurement of the thing we are describing.
That 48% is why a one-time audit does not hold. Half the scripts on a payment page were not put there by the page. They were pulled in by another script — which can change what it pulls tomorrow, without anyone editing anything.
Is your store one of them? Find out in about 20 seconds.
The Webpage Security Checker reads any page of your store from the outside and shows you what is running and where the weak spots are. No account, no card. Want to know which services start collecting before your cookie banner is answered? The Website Tracking Checker does that, free, on the same terms.
A check shows you today. The question is next week. App updates, theme edits and new agency work change your store — usually without anyone telling you. Confirm the store is yours and we keep checking it every week, free.
Two parts of your store. One way of looking at them.
The pages your shoppers browse, and the page that takes their card. Same engine, same weekly report — because both draw the same kind of trouble from the same blind spot: nobody knows what is running there this week.
- Every script and service your pages load, and who put it there
- Which services start collecting before your cookie banner is answered
- Whether the security settings your store should have are switched on, and stay on
- Whether a fix held, or the behaviour came back
Every platform — Shopify, WooCommerce, Magento, custom.
- We walk the path a real shopper takes to pay
- Every script observed on that path, week over week
- Where your checkout normally hands off — and an alert when that changes
- A kept record across your assessment year
On Shopify or BigCommerce? Their vault. Your doorway. We watch the doorway. The payment form sits inside their PCI-validated environment — but the path your shopper takes to reach it, and the destination they are handed to, are still yours.
Nothing goes on your payment page
We watch from outside, so there is no script tag to add and no new vendor on the page that takes card details. That last one matters more than it sounds: under PCI DSS 6.4.3, a security vendor's own tag lands in your scope, and you are the one who has to inventory and authorise it.
AI does the legwork. Experts weigh in. You make the calls.
A store changes constantly and most of those changes are nothing. Raw output would bury you in them.
See how the weekly check works, in full.
Something already landed, and there is a date on it
A processor notice, a privacy demand letter, a remediation backlog with a deadline. A subscription is not what you need first. Bounded engagements with a certified security and PCI professional — we scope you down, do the work, and produce the technical record.
We monitor and report; we do not block attacks, and we do not certify compliance. We are not a QSA or an ASV, and nothing we run satisfies PCI DSS Requirement 11.3.2. Your self-assessment, risk decisions and attestation remain your own.
Questions you probably have
What we check, what happens after the free check, and the letters a store can draw — stolen card details, leaked customer data, a privacy complaint. Plain English.
We make Store Health, which checks your online store from the outside every week and tells you where it stands and what changed. Our AI agent reads your pages the way an attacker or a privacy compliance scanner would — every script, every service, every tracker, and, once you have tested it, the path your shopper takes to pay. It grades what a shopper's browser can see, compares it with your previous check, and ranks each change Should check, Good to check or Recorded only, by rules our security experts built, for what could mean stolen card details, leaked customer data or a privacy complaint. You decide what to do. One product, with a free plan; nothing gets installed on your site, and it works on any platform.
Still have a question? Reach out via the contact form and we'll respond within a business day.