Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 4 down vote favorite

My webshop is currently in the process of becoming PCI compliant.

For business intelligence reasons we would like to include Google analytics code (or a code from a similar package) on the checkout page of our payment funnel.

As this involves including 3rd party JavaScript code on a page which handles customers credit card details I am wondering if this type of integration runs the risk of not passing a PCI audit.

share|improve this question
If we can't give you an answer here then you might want to try on security.stackexchange.com. I think it could belong on either, which is why I'm not flagging it for migration. Posting on two sites is frowned on though, so I'd wait a few days to see if we can answer it before you try it there. – paulmorriss Mar 16 '12 at 14:56
Thanks paulmorriss, I didn't know that one existed. I'll try there if nothing turns up here in a few days. – xenox Mar 16 '12 at 15:04
1  
It will also depend on your PCI auditor – Anagio Mar 16 '12 at 18:33

1 Answer

up vote 3 down vote accepted

To be PCI compliant you have to use a validated payment application. Once a payment app is validated, it has to stay frozen (meaning no coding changes to the application at all).

Is adding javascript to the front end of your website considered a coding change to the application? I would say no, if you host the javascript yourself and you understand what it's doing. You could be PCI compliant with a tracking script in place. However, if the script is hosted by a third party, then the javascript could change without your consent which still doesn't necessarily invalidate your PCI compliance.

My speculation: You can add javascript to the front end without affecting the payment application, if they are two separate entities. Your payment application will not be invalidated, but you have to make sure you can still answer all questions in the PCI questionnaire truthfully. If you can still answer all question truthfully, then you are still PCI compliant.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.