For most small and mid-size stores, cside is the default pick: a permanent free plan covers 2,000 page views a month, and Business starts at $99 per month for 100,000 payment page views, with monitoring in 100 percent of visitor sessions and no sampling. Script Monitoring matches that $99 entry price, with 1,000 page views a month free, then Pro at $99 per month for 100,000 payment page views, with unlimited domains and users on every plan. Five tools show no price on the official page opened on 2026-11-12, so they are quote only: Source Defense, Feroot PaymentGuard, Jscrambler, Reflectiz and DomDog.
Formjacking is a browser attack, not a server attack. A script that your checkout already loads starts reading card fields as a visitor types, then sends the values to an address you did not approve. The page still looks normal and the order still completes, because the theft happens in the visitor browser. That is why a firewall alone cannot stop it.
On this page
Best formjacking protection software: comparison table
Swipe the table sideways on a phone to see every column.
| # | Name | Best for | Starting price | Free plan / trial | Link |
|---|---|---|---|---|---|
| 1 | cside | Small stores that want a free plan and full session coverage | $99 per month for 100,000 payment page views | Yes | Visit |
| 2 | Script Monitoring | Teams that want a published price and unlimited domains | $99 per month for 100,000 payment-page views | Yes | Visit |
| 3 | Source Defense | Large retailers that want script sandboxing | quote only | No | Visit |
| 4 | Cloudflare Client-Side Security | Sites already on Cloudflare with low request volume | $0.099 per 1,000 requests | Yes | Visit |
| 5 | Feroot PaymentGuard | Multi-site enterprises that also need privacy governance | quote only | No | Visit |
| 6 | Jscrambler | Teams that also need JavaScript code protection | quote only | Free trial | Visit |
| 7 | Reflectiz | Teams that cannot add code to their checkout | quote only | Free trial | Visit |
| 8 | DomDog | Small merchants that want hourly remote scanning | quote only | No | Visit |
The 8 best best formjacking protection software tools, in detail
cside
Best for: Small stores that want a free plan and full session coverage
cside watches every third-party script on the pages you configure, in every visitor session, with no sampling. Its pricing page, opened on 2026-11-12, states a permanent free plan at $0 per month for up to 2,000 page views, and Script Security Business starting at $99 per month for up to 100,000 payment page views, scaling to $499 per month for 500,000. You configure cside for payment and checkout pages, plus any page that embeds a payment iframe, and only views on those pages count toward the limit.
- Deployment takes under five minutes with one script tag.
Pros
- Free plan covers 2,000 page views a month
- Business starts at $99 per month for 100,000 payment page views
- monitors scripts in 100 percent of sessions
Cons
- SIEM integration, S3 log push and SSO are Enterprise only
- Fingerprint is priced separately by API calls
Script Monitoring
Best for: Teams that want a published price and unlimited domains
Script Monitoring is a focused tool for payment pages, built around the two PCI DSS requirements most merchants now have to prove. Its homepage, opened on 2026-11-12, lists Free at $0 for 1,000 page views a month with no credit card, Pro at $99 per month for up to 100,000 payment-page views a month, and Enterprise as custom. A page view counts when the monitoring script loads on a page inside the scope you configured.
- The product keeps 6.4.3 and 11.6.1 as separate records, which helps with an assessor.
- Requirement 6.4.3 is the authorisation record: every script on the payment page, who approved it, and the business reason it is allowed there, with in
- Requirement 11.6.1 is the change record: a check of the page and its headers as the consumer browser received them, with an alert when a value changes
Pros
- Free plan covers 1,000 page views a month with no credit card
- Pro starts at $99 per month for 100,000 payment-page views
- scripts, domains, vendors, alerts, blocks and users are unlimited on every plan
Cons
- Pro trial lasts 14 days
- SSO, audit logs and a 99.9 percent uptime SLA are Enterprise only
Source Defense
Best for: Large retailers that want script sandboxing
Source Defense takes a different approach from most tools in this list. Instead of only watching what a script does, Source Defense Protect acts as a sandbox for the JavaScript running on your website, controlling script behaviour at the point of data input. Source Defense Detect is the monitoring side: scanning, AI-driven detection and alerting for client-side threats.
- A third product, Acquirer Protect, is aimed at merchant acquirers and payment service providers.
- The homepage, opened on 2026-11-12, names formjacking, clickjacking, digital skimming, credential harvesting and Magecart as the incidents it covers.
- No price, free plan or trial is shown, so this article lists it as quote only.
Pros
- Protect sandboxes JavaScript and controls script behaviour at the point of data input
- Detect uses scanning, AI-driven detection and alerts
- Acquirer Protect covers a whole merchant portfolio
Cons
- No price is shown on the homepage opened on 2026-11-12, so the cost is quote only
- no free plan or self-serve trial is shown on that page
Cloudflare Client-Side Security
Best for: Sites already on Cloudflare with low request volume
Cloudflare Client-Side Security, formerly called Page Shield, is the client-side product for sites whose traffic already passes through Cloudflare. Its plans page, opened on 2026-11-12, lists Client-Side Security as an add-on at $0.099 per 1,000 requests. Script monitoring is included on every Cloudflare plan, including Free at $0 per month, while change detection and blocking for PCI DSS 11.6.1 sit on the Advanced add-on.
- That meter is the key cost fact in this article.
- A tool that charges by payment-page view bills only checkout traffic, while Cloudflare bills total requests.
- At $0.099 per 1,000 requests, 1,000,000 requests cost $99, and 10,000,000 cost $990, before any base plan cost.
Pros
- Script monitoring is included on every Cloudflare plan, including Free at $0 per month
- Advanced add-on is self-serve at $0.099 per 1,000 requests
- no new vendor tag is needed if traffic already runs through Cloudflare
Cons
- The add-on meter follows total HTTP requests, not payment-page views, so 1,000,000 requests cost $99 and 10,000,000 cost $990
- change detection and blocking sit on the Advanced add-on
Feroot PaymentGuard
Best for: Multi-site enterprises that also need privacy governance
Feroot PaymentGuard is the PCI DSS product inside the wider Feroot platform, alongside DXComply for privacy and DXSecure for client-side security. Its plans page, opened on 2026-11-12, lists three tiers, Assess, Govern and Enterprise, with no dollar figures, and asks visitors to schedule a demo for personalised pricing. Assess covers up to 10 websites and 20 payment pages, Govern covers up to 20 with unlimited payment pages, and Enterprise covers up to 5,000.
- All three tiers list unlimited website visitors, PCI DSS 4 requirements 6.4.3 and 11.6.1, script inventory, runtime payment page monitoring, and ongoi
- Govern adds runtime payment-field protection, while Enterprise adds the full GRC AI automation suite and an enterprise SLA.
Pros
- Assess covers up to 10 websites and apps and up to 20 payment pages
- Govern covers up to 20 websites and apps with unlimited payment pages
- Enterprise covers up to 5,000 websites and apps
Cons
- No price is shown on the plans page opened on 2026-11-12, so the cost is quote only
- no permanent free plan is shown, and support on Assess is tickets plus chat only
Jscrambler
Best for: Teams that also need JavaScript code protection
Jscrambler is the broadest tool in this list, because it protects first-party code as well as third-party tags. Its homepage, opened on 2026-11-12, describes a unified client-side security platform that enforces software integrity at runtime, in the browser. Its two main products are Code Integrity, which protects first-party JavaScript with obfuscation and anti-tampering, and Webpage Integrity, which watches third-party tags.
- That breadth is the reason to pick Jscrambler, and also the reason its quote is hard to compare with a single-purpose tool.
- If you only need PCI DSS 6.4.3 and 11.6.1 evidence for one checkout, you may only need Webpage Integrity.
- No price or free plan is shown, so this article lists it as quote only.
Pros
- Unified platform covers Code Integrity code protection and Webpage Integrity client-side security
- Behavioral Enforcement Core governs runtime behaviour and data access
- covers PCI DSS, GDPR, HIPAA, CIPA, CCPA and the EU AI Act
Cons
- No price is published, so the cost is quote only
- no free plan is shown on the homepage opened on 2026-11-12, only a free trial sign-up
Reflectiz
Best for: Teams that cannot add code to their checkout
Reflectiz is a web exposure management platform that monitors live websites from outside, using its own sandbox browser, so it sees what users and attackers experience without any code on your site. Its homepage, opened on 2026-11-12, states that onboarding takes less than 24 hours with no developer friction, and that there is no agent to install. The engine learns what normal looks like for every script and vendor, and produces time-stamped evidence showing what executed and what changed.
- The platform is organised into hubs: Security Hub simulates real user journeys, Privacy Hub flags trackers that fire before consent, and Offensive Hub
- The trade-off is the monitoring model: because Reflectiz watches through its sandbox browser rather than a tag in every real session, a skimmer that f
Pros
- No code changes and no access to payment data
- onboarding takes less than 24 hours
- PCI Module automates PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1
Cons
- No price is published, so the cost is quote only
- monitoring runs externally through a sandbox browser, not as a tag in every real user session
DomDog
Best for: Small merchants that want hourly remote scanning
DomDog is a narrow, focused tool for PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1, and it offers two monitoring modes. Its homepage, opened on 2026-11-12, describes Remote Scanning, which visits a payment page remotely on an hourly cycle, with no installation and no access to customer data, and a JavaScript Agent, which can be self-hosted on your own servers. The single-page evidence report is a practical strength for a small merchant facing an assessor: it includes the script inventory, user action audit trail, CSP policies discovered and script URLs, and it exports as a PDF.
- Hourly remote scanning will catch a persistent skimmer, but a short-lived script that appears and disappears between scans may not be seen.
Pros
- Remote scanning runs hourly with no installation and no access to customer data
- JavaScript agent can be self-hosted for full control
- single-page evidence report exports as a PDF for an auditor
Cons
- No price is shown on the homepage opened on 2026-11-12, so the cost is quote only
- remote scanning is periodic, not in every live user session
How we chose
We included only tools that name formjacking, Magecart, web skimming or client-side script protection as a core use, and that address PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1. We did not test any tool hands-on. Prices and plan limits come from official vendor pages opened on 2026-11-12, and are cited in Sources. Where the official page showed no price, we wrote quote only. One unique fact that changes the choice is the meter: cside and Script Monitoring charge by payment-page view, Feroot charges by site and payment-page count, and Cloudflare charges by total HTTP request, so the same checkout can cost $99 a month on one meter and $990 on another at 10,000,000 requests.
Pick by checkout volume and budget
| Situation | Best first choice | What you will spend |
|---|---|---|
| One checkout, under 2,000 payment page views a month | cside | $0 per month on the free plan |
| One checkout, under 1,000 payment page views a month | Script Monitoring | $0 per month on the free plan |
| 100,000 payment page views a month, published price | cside or Script Monitoring | $99 per month |
| 500,000 payment page views a month, published price | cside | $499 per month |
| Already on Cloudflare, 1,000,000 total requests a month | Cloudflare Client-Side Security Advanced | $99, from $0.099 per 1,000 requests |
| Already on Cloudflare, 10,000,000 total requests a month | Cloudflare Client-Side Security Advanced | $990, from $0.099 per 1,000 requests |
| Up to 10 sites and 20 payment pages, quote needed | Feroot PaymentGuard Assess | quote only |
| No code changes allowed on checkout | Reflectiz or DomDog | quote only |
Frequently asked questions
What is formjacking protection software?
Formjacking protection software watches the scripts that run on a checkout or payment form, and stops or alerts on code that reads card fields or sends form data to an unapproved address. It works in the visitor browser, where the theft happens, because a server firewall never sees the data leaving the browser. Most tools in this list also build the script inventory and change record that PCI DSS 4.0.1 asks for.
Which formjacking protection tool is best for a small store?
For most small stores, cside is the best first choice, because its free plan covers 2,000 payment page views a month, and Business starts at $99 per month for 100,000 payment page views, with monitoring in every session. Script Monitoring is the closest alternative at the same $99 entry price, with a smaller free allowance of 1,000 page views a month and unlimited domains. Both let you start without a sales call.
How much does formjacking protection software cost?
Published prices in this list start at $0 per month on a free plan, then $99 per month for 100,000 payment page views on cside and Script Monitoring, and $0.099 per 1,000 requests for Cloudflare Client-Side Security Advanced. Five tools show no price on the official page opened on 2026-11-12, so they are listed as quote only. Your final cost depends on the meter: page views, sites, payment pages, or total requests.
Does formjacking protection help with PCI DSS compliance?
Yes, for the client-side parts of the standard. PCI DSS 4.0.1 requirement 6.4.3 asks for an inventory of payment page scripts with a written reason for each one, and requirement 11.6.1 asks for a change detection mechanism that alerts when a payment page or its headers change. Both became mandatory on 31 March 2025. These tools produce that evidence, but compliance itself is a judgement your assessor makes across the whole standard.
Can I protect a checkout without adding code to the page?
Yes. Reflectiz monitors your site externally through a sandbox browser, with no code changes and no access to payment data, and onboarding takes less than 24 hours. DomDog offers remote scanning with no installation, or a self-hosted JavaScript agent if you want full control of the tag. A live-session tag still sees more, because it runs in every real user session, while a remote scan sees the page on its own cycle.
What is the difference between a firewall and formjacking protection?
A firewall inspects requests that reach your servers, while formjacking protection watches code that runs inside the visitor browser. A skimmer reads card fields in the browser and sends the data straight to an attacker address, so the request never reaches your infrastructure and a firewall has nothing to inspect.
Sources
- https://cside.com/
- https://cside.com/pricing
- https://www.scriptmonitoring.com/
- https://sourcedefense.com/
- https://www.cloudflare.com/en-au/plans/
- https://www.feroot.com/plans/
- https://jscrambler.com/
- https://www.reflectiz.com/
- https://domdog.io/
Prices and features were read on each company’s own website in November 2026. They change often, so confirm the current offer on the official site before you sign up or buy.