What problem does it solve?
Harden checkout pages against script injection, Magecart-style card skimming, and accidental expansion of PCI scope by removing unnecessary script risk, enforcing TLS and security headers, and using payment tokenization so card data never touches your servers.
Core Features & Use Cases
- TLS & Security Headers: Enforce HTTPS sitewide and add HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy with appropriate values.
- Nonce-based Content Security Policy (CSP): Generate a per-request nonce in middleware, include it in script-src and style-src, allow Stripe domains for frames, and include a report-uri to capture violations.
- Third-party Script Isolation: Exclude analytics, advertising, and chat widgets from /checkout routes and provide conditional loading patterns for non-checkout pages.
- Payment Tokenization & Safe Payment Integration: Use Stripe Elements or hosted checkout flows so raw card numbers never reach your servers; validate server-side inputs with strong schemas.
- Monitoring & Response: Implement a CSP reporting endpoint that logs violations, alerts on checkout violations, and returns 204 to browsers.
- Use Case: Audit or build a custom checkout on WooCommerce, Shopify, BigCommerce, or a headless storefront to achieve PCI scope reduction and defend against supply-chain script compromises.
Quick Start
Harden the checkout by enforcing HTTPS, adding a nonce-based CSP with a /api/csp-report endpoint, isolating third-party scripts from /checkout, and using Stripe Elements for tokenized payments.
