Third-party script monitoring — know every domain that runs code on your checkout.
Relvato opens your key pages in a real browser, checkout included, and records every outside domain that loads a script on them or receives their data. You approve that list once; after that a new domain fails the run — the moment a card skimmer or a rogue tag starts loading, not weeks later.
- ✓Every outside domain that loads a script on your key pages, checkout included
- ✓Where your pages send data: fetch, XHR, WebSocket and event-stream destinations
- ✓Scripts imported and requests made by service workers
- ✓A new, unapproved domain fails the run — with the page and a sample address
- ✓One-click approve, per domain or all at once
- ✓Re-checked daily and after plugin, theme, core and WooCommerce updates
Card skimmers rarely touch your files. They ride in through a compromised plugin, a tag manager or someone else’s script, and send card details to a domain you’ve never heard of — so a file scanner on the server never sees them. What does change is visible from the outside: a new domain loading code, or receiving data, on the pages where people pay.
- Relvato loads your home, shop, product, cart, checkout and account pages — plus any you add — in a real browser and records the outside domains behind scripts, fetch and XHR requests, WebSockets and event streams. Images, fonts and styles are left out: they can’t run code and would only add noise.
- The first scan lists what it found for you to approve — your analytics, payment provider, chat widget. From then on a domain that isn’t on the approved list fails the run, with the page it appeared on and a sample address, and approving one that’s yours takes a click.
- Service workers are watched too: what a page’s service worker imports and the requests it makes don’t pass through the page, so Relvato records them for the whole browser session. It runs daily and right after plugin, theme, WordPress and WooCommerce updates reported by the Relvato plugin.
How is this different from a malware scanner?
A scanner looks at the files on your server. A skimmer injected through a tag manager or a compromised third-party script never touches them — but it has to load from somewhere and send data somewhere. Relvato watches that from the outside, the way your visitors’ browsers see it.
Will my analytics and chat widgets set off alerts?
Only once: the first scan lists every outside domain your pages already use, for you to approve. After that only a new one alerts, and approving a legitimate one takes a click.
Does it help with PCI DSS 4.0?
PCI DSS 4.0 asks merchants to keep an inventory of the scripts on payment pages (requirement 6.4.3) and to detect unauthorised changes to them (11.6.1). Relvato’s approved list and new-domain alerts support both, but they don’t replace your own PCI assessment.
Do I need a plugin?
No — it works on any site with a verified domain, by watching your pages from the outside. With the Relvato plugin on WordPress it also re-checks right after plugin, theme, core and WooCommerce updates.
Put this monitor on autopilot.
Free forever on one site — 100 runs a month, started by you or weekly, no card. Pro re-runs your monitors by itself after every update.