You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/page-shield/alerts/index.mdx
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,12 +1,12 @@
1
1
---
2
-
title: Page Shield alerts
2
+
title: Alerts
3
3
pcx_content_type: concept
4
4
sidebar:
5
5
order: 5
6
6
group:
7
7
label: Alerting
8
-
description: Page Shield alerts notify you when new scripts are detected
9
-
on your domain or when Page Shield detects resources that are likely
8
+
description: Cloudflare client-side resource alerts notify you when new scripts
9
+
are detected on your domain or when Cloudflare detects resources that are likely
10
10
malicious.
11
11
---
12
12
@@ -30,7 +30,7 @@ You can configure unscoped or scoped alerts:
30
30
31
31
For alerts sent at regular intervals, you might experience a delay between adding a new script and receiving an alert.
32
32
33
-
For instructions on configuring alerts, refer to [Configure a Page Shield alert](/page-shield/alerts/configure/).
33
+
For instructions on configuring alerts, refer to [Configure an alert](/page-shield/alerts/configure/).
34
34
35
35
## Scoped alerts
36
36
@@ -42,11 +42,11 @@ If you have configured [allow policies](/page-shield/policies/#policy-actions) i
42
42
43
43
When you create a scoped alert using the **Policies of these zones** alert filter, you will only receive the most relevant notifications based on the values of the allow policies you configured.
44
44
45
-
For each scoped alert, Page Shield does the following:
45
+
For each scoped alert, Cloudflare does the following:
46
46
47
47
1. Check which allow policies in a zone are enabled.
48
48
2. For every enabled policy, compare the URL of the new or changed resource against the allowed sources in the policy.
49
-
3. If the resource is allowed by the policy, check if the new or modified resource should trigger the current Page Shield alert.
49
+
3. If the resource is allowed by the policy, check if the new or modified resource should trigger the current alert.
50
50
4. If the alert should trigger, send an alert notification to the configured destinations.
51
51
52
52
When you create a scoped alert you will not receive notifications for resources blocked by an allow policy. These are [policy violations](/page-shield/policies/violations/) that you can review in the dashboard, through GraphQL, or via Logpush.
Copy file name to clipboardExpand all lines: src/content/docs/page-shield/best-practices/handle-an-alert.mdx
+11-9Lines changed: 11 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,24 +1,26 @@
1
1
---
2
-
title: Handle a Page Shield alert
2
+
title: Handle a client-side resource alert
3
3
pcx_content_type: tutorial
4
-
updated: 2023-03-23
4
+
updated: 2025-06-13
5
5
sidebar:
6
6
order: 2
7
7
label: Handle an alert
8
8
---
9
9
10
-
If you receive a Page Shield alert, sometimes you need to perform some manual investigation to confirm the nature of the script. Use the guidance provided in this page as a starting point for your investigation.
10
+
If you receive a client-side resource alert, sometimes you need to perform some manual investigation to confirm the nature of the script. Use the guidance provided in this page as a starting point for your investigation.
11
11
12
12
## 1. Understand what triggered the alert
13
13
14
-
Start by identifying the [detection system](/page-shield/how-it-works/malicious-script-detection/) that triggered the alert. A link is provided in the alert that will send you directly to the Page Shield dashboard to the relevant resource that needs reviewing. Alternatively, do the following:
14
+
Start by identifying the [detection system](/page-shield/how-it-works/malicious-script-detection/) that triggered the alert. A link is provided in the alert that will send you directly to the Cloudflare dashboard to the relevant resource that needs reviewing. Alternatively, do the following:
15
15
16
16
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
17
-
2. Go to **Security** > **Page Shield**.
17
+
2. Navigate to the client-side resource monitoring page:
18
+
- Old dashboard: Go to **Security** > **Page Shield**.
19
+
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
18
20
3. Select **Scripts** or **Connections** and search for the resource mentioned on the alert you received.
19
21
4. Select **Details** next to the resource you identified. The example screenshot below shows a malicious script resource.
20
22
21
-

23
+

22
24
23
25
The details page will specify which detection system triggered the alert. Check the values of the following fields:
24
26
@@ -58,11 +60,11 @@ In this case, in addition to the steps indicated below, the best approach is:
58
60
59
61
## 3. Check the script reputation
60
62
61
-
If Page Shield considers the resource’s domain a "malicious domain", it is likely that the domain does not have a good reputation. The domain may be known for hosting malware or for being used for phishing attacks. Usually, reviewing the domain/hostname is sufficient to understand why you received the alert. You can use tools like Cloudflare's [Security Center Investigate](https://dash.cloudflare.com/?to=/:account/security-center/investigate) platform to help with this validation.
63
+
If Cloudflare considers the resource’s domain a "malicious domain", it is likely that the domain does not have a good reputation. The domain may be known for hosting malware or for being used for phishing attacks. Usually, reviewing the domain/hostname is sufficient to understand why you received the alert. You can use tools like Cloudflare's [Security Center Investigate](https://dash.cloudflare.com/?to=/:account/security-center/investigate) platform to help with this validation.
62
64
63
65
If Cloudflare's internal systems classified the script as containing "malicious code", external tools may not confirm the detection you got from Page Shield, since the machine learning (ML) model being used is Cloudflare-specific technology.
64
66
65
-
If you believe that Page Shield's classification is a false positive, contact your account team so that we can further improve Page Shield's underlying technology.
67
+
If you believe that Cloudflare's classification is a false positive, contact your account team so that we can further improve Page Shield's underlying technology.
66
68
67
69
## 4. (Optional) Analyze the script content
68
70
@@ -76,7 +78,7 @@ You could use a virtual machine to perform some of the following analysis:
76
78
77
79
## Conclusion
78
80
79
-
If a resource which triggered a malicious alert from Page Shield:
81
+
If a resource which triggered a malicious resource alert:
80
82
81
83
- Is actively present in your application
82
84
- Is being loaded from a malicious host or IP address, or has malicious code
Copy file name to clipboardExpand all lines: src/content/docs/page-shield/detection/monitor-connections-scripts.mdx
+27-19Lines changed: 27 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,31 +7,32 @@ sidebar:
7
7
8
8
import { Render } from"~/components";
9
9
10
-
Once you [activate Page Shield](/page-shield/get-started/), the **Monitors** dashboard will show which resources (scripts and connections) are running on your domain, as well as the cookies recently detected in HTTP traffic.
10
+
Once you [activate Page Shield's client-side resource monitoring](/page-shield/get-started/), the main client-side resources dashboard will show which resources (scripts and connections) are running on your domain, as well as the cookies recently detected in HTTP traffic.
11
11
12
12
If you notice unexpected scripts or connections on the dashboard, check them for signs of malicious activity. Enterprise customers with a paid add-on will have their [connections and scripts classified as potentially malicious](/page-shield/how-it-works/malicious-script-detection/) based on threat feeds. You should also check for any new or unexpected cookies.
13
13
14
14
:::note
15
15
16
-
- Users in Free and Pro plans only have access to the script monitor.
17
-
- If you recently activated Page Shield, you may see a delay in reporting.
16
+
- Users in Free and Pro plans only have access to script monitoring.
17
+
- If you recently activated client-side resource monitoring, you may see a delay in reporting.
18
18
19
19
:::
20
20
21
-
## Use the Monitors dashboard
21
+
## Use the client-side resources dashboards
22
22
23
-
To review the resources and cookies detected by Page Shield:
23
+
To review the resources detected by Cloudflare:
24
24
25
25
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
26
26
27
-
2. Go to **Security** > **Page Shield**.
27
+
2. Go to the client-side resources page:
28
+
- Old dashboard: Go to **Security** > **Page Shield**.
29
+
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
28
30
29
-
3. Under **Monitors**, review the list of scripts, connections, and cookies for your domain. To apply a filter, select **Add filter** and use one or more of the available options:
30
-
31
-
-**Script**: Filter scripts by their URL.
32
-
-**Connection**: Filter connections by their target URL. Depending on your [configuration](/page-shield/reference/settings/#connection-target-details), it may search only by target hostname.
33
-
-**Host**: Look for scripts appearing on specific hostnames, or connections made in a specific hostname.
34
-
-**Page** (requires a Business or Enterprise plan): Look for scripts appearing in a specific page, or for connections made in a specific page. Searches the first page where the script was loaded (or where the connection was made) and the latest occurrences list.
31
+
3. Review the list of scripts, connections, and cookies for your domain. To apply a filter, select **Add filter** and use one or more of the available options:
32
+
-**Script URL**: Filter scripts by their URL.
33
+
-**Connection URL**: Filter connections by their target URL. Depending on your [configuration](/page-shield/reference/settings/#connection-target-details), it may search only by target hostname.
34
+
-**Seen on host**: Look for scripts appearing on specific hostnames, or connections made in a specific hostname.
35
+
-**Seen on page** (requires a Business or Enterprise plan): Look for scripts appearing in a specific page, or for connections made in a specific page. Searches the first page where the script was loaded (or where the connection was made) and the latest occurrences list.
35
36
-**Status**: Filter scripts or connections by [status](/page-shield/reference/script-statuses/).
36
37
-**Type**: Filter cookies according to their type: first-party cookies or unknown.
37
38
- Cookie property: Filter by a cookie property such as **Name**, **Domain**, **Path**, **Same site**, **HTTP only**, and **Secure**.
@@ -40,12 +41,15 @@ To review the resources and cookies detected by Page Shield:
40
41
41
42
## View all reported scripts or connections
42
43
43
-
The All Reported Connections and All Reported Scripts dashboards show all the detected resources including infrequent or inactive ones, reported in the last 30 days. After 30 days without any report, Page Shield will delete information about a previously reported resource, and it will no longer appear in any of the dashboards.
44
+
The All Reported Connections and All Reported Scripts dashboards show all the detected resources including infrequent or inactive ones, reported in the last 30 days. After 30 days without any report, Cloudflare will delete information about a previously reported resource, and it will no longer appear in any of the dashboards.
44
45
45
46
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
46
-
2. Go to **Security** > **Page Shield** > **Monitors**.
47
+
2. Go to the client-side resources page:
48
+
- Old dashboard: Go to **Security** > **Page Shield**.
49
+
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
50
+
47
51
3. Select **Scripts** or **Connections**.
48
-
4. Select **View all**.
52
+
4. Select **View all scripts** or **View all connections**.
49
53
5. Review the information displayed in the dashboard.
50
54
51
55
You can filter the data in these dashboards using different criteria, and print a report with the displayed records.
@@ -77,7 +81,6 @@ The script details also include the last 10 script versions detected by Page Shi
77
81
The details of each cookie include:
78
82
79
83
-**Type**: A cookie can have the following types:
80
-
81
84
-**First-party**: Cookies set by the origin server through a `set-cookie` HTTP response header.
82
85
-**Unknown**: All other detected cookies.
83
86
@@ -113,6 +116,11 @@ Use this feature to extract data from Page Shield that you can review and annota
113
116
114
117
To export script, connection, or cookie information in CSV format:
115
118
116
-
1. Go to the **Monitors** tab and select **Scripts**, **Connections**, or **Cookies**.
117
-
2. (Optional) Apply any filters to the displayed data.
118
-
3. Select **Download CSV**.
119
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
120
+
2. Go to the client-side resources page:
121
+
- Old dashboard: Go to **Security** > **Page Shield**.
122
+
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
123
+
124
+
3. Select **Scripts**, **Connections**, or **Cookies**.
125
+
4. (Optional) Apply any filters to the displayed data.
Copy file name to clipboardExpand all lines: src/content/docs/page-shield/detection/review-changed-scripts.mdx
+6-2Lines changed: 6 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,12 +11,16 @@ description: Learn how to review scripts on your domain after receiving a code c
11
11
Available as a paid add-on for customers on an Enterprise plan.
12
12
:::
13
13
14
-
Page Shield analyzes the JavaScript dependencies in the pages of your domain over time.
14
+
Cloudflare analyzes the JavaScript dependencies in the pages of your domain over time.
15
15
16
16
You can configure a notification for [code change alerts](/page-shield/alerts/alert-types/#code-change-alert) to receive a daily notification about changed scripts in your domain.
17
17
18
18
When you receive such a notification:
19
19
20
20
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
21
-
2. Go to **Security** > **Page Shield** > **Monitors**.
21
+
2. Go to the client-side resources page:
22
+
23
+
- Old dashboard: Go to **Security** > **Page Shield**.
24
+
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
25
+
22
26
3. Check the details of each changed script and validate if it is an expected change.
0 commit comments