What it is
Page Shield monitors the JavaScript and third-party scripts running in your users' browsers to catch client-side and supply-chain attacks like MagecartMagecartA style of attack that injects card-skimming JavaScript into checkout pages to steal payment details. digital skimming. It alerts you when new or modified scripts appear and helps you enforce a Content Security PolicyCSPContent Security Policy — a browser rule set that controls which scripts and resources a page is allowed to load..
Why it helps the client
- Detects malicious or unexpected third-party scripts stealing card and PII data (Magecart).
- Maintains a continuous inventory of every script and the connections it makes.
- Helps meet PCI DSS 4.0 client-side security requirements.
- Alerts on new or changed scripts so supply-chain compromises are caught fast.
Why they'd want it
- Client-side attacks bypass server-side WAFs — this is the missing piece.
- A concrete path to PCI DSS 4.0 compliance for payment pages.
- Protect customer trust: skimming attacks are silent and brand-damaging.
🔬 How it actually works
- Page Shield is client-side security: it reports the scripts and network connections running in your users' browsers — via the browser's Content-Security-Policy reporting plus Cloudflare's analysis — and builds a live inventory of first- and third-party scripts.
- It flags new, changed, or malicious scripts and connections — the signature of MagecartMagecartA style of attack that injects card-skimming JavaScript into checkout pages to steal payment details. / formjacking supply-chain attacks that server-side tools literally cannot see, because the malicious code runs in the browser and exfiltrates straight to the attacker.
- It helps you build and enforce a Content Security PolicyCSPContent Security Policy — a browser rule set that controls which scripts and resources a page is allowed to load., and delivers the client-side script monitoring that PCI DSS 4.0PCI DSSPayment Card Industry Data Security Standard — the security rules everyone handling credit-card data must follow. (requirements 6.4.3 and 11.6.1) now mandates for payment pages.
- Alerts fire when a new script appears or a known script starts talking to a new domain, so a supply-chain compromise is caught quickly rather than months later.
📖 Key terms on this page hover any underlined term anywhere on the site for its definition
- Magecart
- A style of attack that injects card-skimming JavaScript into checkout pages to steal payment details.
- CSP
- Content Security Policy — a browser rule set that controls which scripts and resources a page is allowed to load.
- PCI DSS
- Payment Card Industry Data Security Standard — the security rules everyone handling credit-card data must follow.
- WAF
- Web Application Firewall — inspects web requests and blocks malicious ones (like SQL injection and XSS) before they reach your site.
- CDN
- Content Delivery Network — a worldwide set of servers that keep copies of your content close to users so pages load faster.
- origin
- Your own web server or host where your website actually lives. Cloudflare sits in front of it.
Live demo walkthrough
5 stepsScreens below are annotated recreations of the Cloudflare dashboard. The numbered orange pin marks exactly where to click.
Select the website
Websites
Select a website to manage its configuration.
👉 Do this
Open the site — ideally one with a checkout or payment page.
💬 Say this
“This one matters most for anyone taking payments online. Let's look at what runs in the customer's browser.”
Open Security → Page Shield
Security
Page Shield
👉 Do this
Expand Security and click Page Shield.
💬 Say this
“Everything so far protects the server side. Page Shield protects the client side — the code executing in your users' browsers, which a traditional WAF can't see.”
Enable monitoring
Security
Page Shield
👉 Do this
Toggle Page Shield on.
💬 Say this
“One switch turns on monitoring. Cloudflare then inventories every script your pages load and every connection those scripts make.”
Inspect detected scripts
Security
Page Shield
👉 Do this
Review the script inventory and flag the newly-seen third-party script.
💬 Say this
“Here's every third-party script, where it's hosted, and when it first appeared. That 'promo-widget.js' from an unknown CDN, first seen two hours ago, is exactly the kind of supply-chain change Page Shield flags — before it skims a single card number. This is also how customers satisfy PCI DSS 4.0.”
Set a policy & get alerted
Security
Page Shield
👉 Do this
Show configuring a policy/alert so new or disallowed scripts trigger a notification.
💬 Say this
“Finally we set a policy: alert us — or block outright — the moment a script or connection appears that isn't on our allow-list. So the next supply-chain compromise pages the security team in real time instead of surfacing in a breach report months later.”