Payment Page Tamper Detection

If Salesforce Payments detects changes to a payment web page header or the insertion of javascript, it triggers a Content Security Policy (CSP) platform event with these fields:

• Context––URL of the payment page where the change occurred.
• Notification Type–Header or script change.
• Notification Message–Tells the admin what change was detected.

To secure customer payment information, subscribe to these events, and, if necessary, take corrective action. To receive these events, create an Apex trigger or a platform event-triggered flow. For more information, see Subscribing to Platform Events.

Note Payment pages that use the Salesforce Payments, Payment, or Dual Payment Experience Builder components are compliant by default. If you use a third-party payment provider with a custom payment component, verify whether change detection is implemented.