What's running on your checkout?

Only run this on a shop you own or manage.

What this can and can't do. It shows you what loads on your checkout today, so you can spot anything you don't recognise. It can't prove your checkout is safe. Card-skimming code is built to hide: some only switches on at the payment step, some goes quiet when it sees the browser's developer tools open, and some runs on the server, where a browser never sees it. If anything here worries you, talk to your developer, your host and your payment provider.

Step 1, in Chrome on a computer (about fifteen minutes).

1. How customers pay. Put something in your basket and go to the payment step, but don't pay. Note which of these happens:
a) you're sent to your payment provider's own page to enter the card (the address bar changes to their website);
b) the card boxes sit on your page but come from the provider (often with the provider's name or logo on them);
c) the card boxes look like part of your own page, or you can't tell.
2. What loads on the payment page. On that page, press F12 (or right-click and choose Inspect) to open the developer tools. Click the Network tab, click JS to show scripts only, then reload the page. If there's no Domain column, right-click the column headings and tick Domain. Write down every domain in that column, once each. Close the developer tools when you're done.