Know the moment a card skimmer lands on your checkout
Web skimming attacks add a few lines of script to a payment page that quietly copy what customers type. The checkout keeps working, so shops usually hear about it from their bank weeks later. Webforta watches your checkout pages and tells you when something new starts loading there.
Skimmers hide in plain sight
A skimmer rarely changes how a page looks. It loads a script from a server the attacker controls, or hides inside a script you already trust, and sends card details away as customers type them.
- Customers see nothing unusual: the order goes through as normal.
- Common entry points are outdated plugins and extensions, stolen admin passwords and compromised third-party scripts.
- A single infected checkout can expose every card used on it until someone notices.
Script inventory
Each checkout page you add (Starter, Pro and Business) is checked with your monitoring, and every script it loads from another server is recorded.
New-script alerts
A script from a new server on a payment page alerts you at once, with the exact address it loads from, so you can tell your payment provider from a stranger.
Hourly malware check
On Starter, Pro and Business, checkout pages are checked every hour for obfuscated scripts, hidden iframes and scripts served from raw IP addresses.
Integrity checks
The scanner flags third-party scripts loaded without Subresource Integrity, and a missing Content-Security-Policy, the two browser features that stop a swapped script from running.
Block the way in
On Pro and Business, Shield blocks the injection attacks and malicious uploads skimmers usually arrive through, and slows password guessing on admin logins.
Checkout uptime
The same checks tell you when checkout is down or slow, or when the word you expect on the page (for example "Pay now") disappears.
What it can and cannot see
Webforta checks your pages the way a visitor would, from the outside. It sees the scripts the page loads for its checks; a skimmer that turns on only for some countries, devices or signed-in customers can stay hidden from it. It notices scripts loaded from new addresses, not a change inside a script that keeps the same address, so a compromised script you already use is caught only if it adds injected code the hourly malware check recognises. It cannot read the payment provider's own hosted page.
Use the alerts as an early warning alongside keeping your platform and extensions up to date, strong admin passwords with two-factor authentication, and a Content-Security-Policy on checkout pages.
From setup to protected, step by step
Add your checkout pages
On a verified website, list the pages that take payment or personal details: the cart, checkout and payment steps, the login page.
Webforta records what loads there
Every check records the scripts each page loads from other servers. The first check builds the baseline.
A new script alerts you
When a script from a new server appears on a payment page, you get an alert at once with the address it loads from, the usual sign that a card skimmer was added.
Confirm or act
If you added it (a new payment or analytics provider), it becomes part of the baseline. If not, follow the recovery guide and block it while you clean up.
Frequently asked
What is web skimming (Magecart)?
Attackers add a small script to a payment page that copies what customers type, such as card numbers, and sends it to their own server. The page keeps working, so neither the shop nor its customers notice.
How does Webforta notice a skimmer?
It records the scripts each of your checkout pages loads from other servers and alerts you when a new one appears. It also checks the page for injected code every hour, and the scanner flags third-party scripts loaded without an integrity check.
Can it catch a skimmer that only targets some visitors?
Not always. Webforta sees what the page serves to its checks. Skimmers that activate only for certain countries, devices or logged-in customers can be missed, so treat alerts as an early warning, not a guarantee.
Does this make my shop PCI DSS compliant?
No tool makes a shop compliant by itself. PCI DSS 4.0 asks merchants to keep an inventory of payment-page scripts and to detect unauthorised changes (requirements 6.4.3 and 11.6.1). Webforta's script inventory and change alerts can support that work; your assessor decides what is enough.
My checkout is hosted by the payment provider. Do I need this?
If customers type card details only on the provider's own page, the main risk moves to your store pages and the redirect to the provider. Watching those pages still catches injected scripts that send customers somewhere else.
See what your website shows attackers
Start a free 14-day trial, prove you own your website and run your first scan in about ten minutes. No card required.