You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
You can enable and disable Page Shield, configure its settings, and fetch information about detected scripts and connections using the [Page Shield API](/api/resources/page_shield/methods/get/).
10
+
You can enable and disable Page Shield's client-side resource monitoring, configure settings, and fetch information about detected scripts and connections using the [Page Shield API](/api/resources/page_shield/methods/get/).
11
11
12
12
To authenticate API requests you need an [API token](/fundamentals/api/get-started/create-token/). For more information on the required API token permissions, refer to [Roles and permissions](/page-shield/reference/roles-and-permissions/).
13
13
@@ -464,7 +464,7 @@ This `GET` request obtains the details of a cookie detected by Page Shield with
464
464
465
465
### Create a policy
466
466
467
-
This `POST` request creates a Page Shield policy with _Log_ action, defining the following scripts as allowed based on where they are hosted:
467
+
This `POST` request creates a Page Shield policy (or content security rule) with _Log_ action, defining the following scripts as allowed based on where they are hosted:
468
468
469
469
- Scripts hosted in `myapp.example.com` (which does not include scripts in `example.com`).
470
470
- Scripts hosted in `cdnjs.cloudflare.com`.
@@ -476,7 +476,7 @@ All other scripts would trigger a policy violation, but those scripts would not
476
476
For more information on <GlossaryTooltipterm="content security policy (CSP)">Content Security Policy (CSP)</GlossaryTooltip> directives and values, refer to the [MDN documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy).
477
477
478
478
:::note
479
-
For a list of CSP directives and keywords supported by Page Shield policies, refer to [CSP directives supported by policies](/page-shield/policies/csp-directives/).
479
+
For a list of CSP directives and keywords supported by policies, refer to [CSP directives supported by policies](/page-shield/policies/csp-directives/).
When enabled, Page Shield uses a <GlossaryTooltipterm="content security policy (CSP)">Content Security Policy (CSP)</GlossaryTooltip> [report-only HTTP header](/page-shield/reference/csp-header/) to gather information about all the scripts running on your application.
12
+
When enabled, Page Shield's client-side resource monitoring uses a <GlossaryTooltipterm="content security policy (CSP)">Content Security Policy (CSP)</GlossaryTooltip> [report-only HTTP header](/page-shield/reference/csp-header/) to gather information about all the scripts running on your application.
13
13
14
14
By default, reports are sent to a Cloudflare-owned endpoint:
15
15
@@ -28,17 +28,29 @@ Enterprise customers with a paid add-on can change the reporting endpoint so tha
28
28
Using the same hostname for CSP reporting may interfere with other Cloudflare products. Before selecting this option, ensure that your Cloudflare configuration complies with the following:
29
29
30
30
- No rate limiting rules match the `cdn-cgi/*` URL path
31
-
- No WAF custom rules match the `cdn-cgi/*` URL path
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
72
+
2. Go to **Security** > **Settings** > **Client-side abuse** tab.
73
+
3. Under **Continuous script monitoring** > **Configurations**, select the edit icon next to **Data processing**.
74
+
4. Select **Log host only** to analyze only the hostname or **Log full URI** to use the full URI.
75
+
5. Save your changes.
76
+
77
+
</TabItem> </Tabs>
56
78
57
-
When you turn off Page Shield, you lose visibility on the scripts running on your zone, the outbound connections made from pages in your domain, and cookies detected in HTTP traffic.
79
+
## Turn off client-side resource monitoring
58
80
59
-
To turn off Page Shield:
81
+
When you turn off Page Shield's client-side resource monitoring, you lose visibility on the scripts running on your zone, the outbound connections made from pages in your domain, and cookies detected in HTTP traffic.
0 commit comments