Skip to content

Commit d4f3a3a

Browse files
authored
[Page Shield] Add new nav instructions (#23555)
1 parent 20cd457 commit d4f3a3a

21 files changed

+244
-137
lines changed

src/content/docs/page-shield/alerts/alert-types.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ sidebar:
88

99
import { AvailableNotifications } from "~/components";
1010

11-
You can configure alerts for resources detected in your domain. Refer to [Page Shield alerts](/page-shield/alerts/) for more information.
11+
You can configure alerts for resources detected in your domain. Refer to [Alerts](/page-shield/alerts/) for more information.
1212

1313
## New resource alerts
1414

src/content/docs/page-shield/alerts/configure.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
---
2-
title: Configure a Page Shield alert
2+
title: Configure an alert
33
pcx_content_type: how-to
44
sidebar:
55
order: 2
66
label: Configure an alert
7-
description: Configure scoped or unscoped Page Shield alerts to get notified about relevant client-side changes on your zones.
7+
description: Configure scoped or unscoped client-side resource alerts to get notified about relevant client-side changes on your zones.
88
---
99

1010
import { Render } from "~/components";

src/content/docs/page-shield/alerts/index.mdx

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
---
2-
title: Page Shield alerts
2+
title: Alerts
33
pcx_content_type: concept
44
sidebar:
55
order: 5
66
group:
77
label: Alerting
8-
description: Page Shield alerts notify you when new scripts are detected
9-
on your domain or when Page Shield detects resources that are likely
8+
description: Cloudflare client-side resource alerts notify you when new scripts
9+
are detected on your domain or when Cloudflare detects resources that are likely
1010
malicious.
1111
---
1212

@@ -30,7 +30,7 @@ You can configure unscoped or scoped alerts:
3030

3131
For alerts sent at regular intervals, you might experience a delay between adding a new script and receiving an alert.
3232

33-
For instructions on configuring alerts, refer to [Configure a Page Shield alert](/page-shield/alerts/configure/).
33+
For instructions on configuring alerts, refer to [Configure an alert](/page-shield/alerts/configure/).
3434

3535
## Scoped alerts
3636

@@ -42,11 +42,11 @@ If you have configured [allow policies](/page-shield/policies/#policy-actions) i
4242

4343
When you create a scoped alert using the **Policies of these zones** alert filter, you will only receive the most relevant notifications based on the values of the allow policies you configured.
4444

45-
For each scoped alert, Page Shield does the following:
45+
For each scoped alert, Cloudflare does the following:
4646

4747
1. Check which allow policies in a zone are enabled.
4848
2. For every enabled policy, compare the URL of the new or changed resource against the allowed sources in the policy.
49-
3. If the resource is allowed by the policy, check if the new or modified resource should trigger the current Page Shield alert.
49+
3. If the resource is allowed by the policy, check if the new or modified resource should trigger the current alert.
5050
4. If the alert should trigger, send an alert notification to the configured destinations.
5151

5252
When you create a scoped alert you will not receive notifications for resources blocked by an allow policy. These are [policy violations](/page-shield/policies/violations/) that you can review in the dashboard, through GraphQL, or via Logpush.

src/content/docs/page-shield/best-practices/handle-an-alert.mdx

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,26 @@
11
---
2-
title: Handle a Page Shield alert
2+
title: Handle a client-side resource alert
33
pcx_content_type: tutorial
4-
updated: 2023-03-23
4+
updated: 2025-06-13
55
sidebar:
66
order: 2
77
label: Handle an alert
88
---
99

10-
If you receive a Page Shield alert, sometimes you need to perform some manual investigation to confirm the nature of the script. Use the guidance provided in this page as a starting point for your investigation.
10+
If you receive a client-side resource alert, sometimes you need to perform some manual investigation to confirm the nature of the script. Use the guidance provided in this page as a starting point for your investigation.
1111

1212
## 1. Understand what triggered the alert
1313

14-
Start by identifying the [detection system](/page-shield/how-it-works/malicious-script-detection/) that triggered the alert. A link is provided in the alert that will send you directly to the Page Shield dashboard to the relevant resource that needs reviewing. Alternatively, do the following:
14+
Start by identifying the [detection system](/page-shield/how-it-works/malicious-script-detection/) that triggered the alert. A link is provided in the alert that will send you directly to the Cloudflare dashboard to the relevant resource that needs reviewing. Alternatively, do the following:
1515

1616
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
17-
2. Go to **Security** > **Page Shield**.
17+
2. Navigate to the client-side resource monitoring page:
18+
- Old dashboard: Go to **Security** > **Page Shield**.
19+
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
1820
3. Select **Scripts** or **Connections** and search for the resource mentioned on the alert you received.
1921
4. Select **Details** next to the resource you identified. The example screenshot below shows a malicious script resource.
2022

21-
![Page Shield dialog box showing the details of a script considered malicious.](~/assets/images/page-shield/handle-alert-malicious-script-example.png)
23+
![Dialog box showing the details of a script considered malicious.](~/assets/images/page-shield/handle-alert-malicious-script-example.png)
2224

2325
The details page will specify which detection system triggered the alert. Check the values of the following fields:
2426

@@ -58,11 +60,11 @@ In this case, in addition to the steps indicated below, the best approach is:
5860

5961
## 3. Check the script reputation
6062

61-
If Page Shield considers the resource’s domain a "malicious domain", it is likely that the domain does not have a good reputation. The domain may be known for hosting malware or for being used for phishing attacks. Usually, reviewing the domain/hostname is sufficient to understand why you received the alert. You can use tools like Cloudflare's [Security Center Investigate](https://dash.cloudflare.com/?to=/:account/security-center/investigate) platform to help with this validation.
63+
If Cloudflare considers the resource’s domain a "malicious domain", it is likely that the domain does not have a good reputation. The domain may be known for hosting malware or for being used for phishing attacks. Usually, reviewing the domain/hostname is sufficient to understand why you received the alert. You can use tools like Cloudflare's [Security Center Investigate](https://dash.cloudflare.com/?to=/:account/security-center/investigate) platform to help with this validation.
6264

6365
If Cloudflare's internal systems classified the script as containing "malicious code", external tools may not confirm the detection you got from Page Shield, since the machine learning (ML) model being used is Cloudflare-specific technology.
6466

65-
If you believe that Page Shield's classification is a false positive, contact your account team so that we can further improve Page Shield's underlying technology.
67+
If you believe that Cloudflare's classification is a false positive, contact your account team so that we can further improve Page Shield's underlying technology.
6668

6769
## 4. (Optional) Analyze the script content
6870

@@ -76,7 +78,7 @@ You could use a virtual machine to perform some of the following analysis:
7678

7779
## Conclusion
7880

79-
If a resource which triggered a malicious alert from Page Shield:
81+
If a resource which triggered a malicious resource alert:
8082

8183
- Is actively present in your application
8284
- Is being loaded from a malicious host or IP address, or has malicious code

src/content/docs/page-shield/best-practices/index.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,6 @@ description: Best practices for using Page Shield.
1111

1212
import { DirectoryListing } from "~/components";
1313

14-
Review the topics below for best practices related to Page Shield:
14+
Review the topics below for best practices related to Page Shield's client-side resource monitoring:
1515

1616
<DirectoryListing />

src/content/docs/page-shield/detection/monitor-connections-scripts.mdx

Lines changed: 27 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -7,31 +7,32 @@ sidebar:
77

88
import { Render } from "~/components";
99

10-
Once you [activate Page Shield](/page-shield/get-started/), the **Monitors** dashboard will show which resources (scripts and connections) are running on your domain, as well as the cookies recently detected in HTTP traffic.
10+
Once you [activate Page Shield's client-side resource monitoring](/page-shield/get-started/), the main client-side resources dashboard will show which resources (scripts and connections) are running on your domain, as well as the cookies recently detected in HTTP traffic.
1111

1212
If you notice unexpected scripts or connections on the dashboard, check them for signs of malicious activity. Enterprise customers with a paid add-on will have their [connections and scripts classified as potentially malicious](/page-shield/how-it-works/malicious-script-detection/) based on threat feeds. You should also check for any new or unexpected cookies.
1313

1414
:::note
1515

16-
- Users in Free and Pro plans only have access to the script monitor.
17-
- If you recently activated Page Shield, you may see a delay in reporting.
16+
- Users in Free and Pro plans only have access to script monitoring.
17+
- If you recently activated client-side resource monitoring, you may see a delay in reporting.
1818

1919
:::
2020

21-
## Use the Monitors dashboard
21+
## Use the client-side resources dashboards
2222

23-
To review the resources and cookies detected by Page Shield:
23+
To review the resources detected by Cloudflare:
2424

2525
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
2626

27-
2. Go to **Security** > **Page Shield**.
27+
2. Go to the client-side resources page:
28+
- Old dashboard: Go to **Security** > **Page Shield**.
29+
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
2830

29-
3. Under **Monitors**, review the list of scripts, connections, and cookies for your domain. To apply a filter, select **Add filter** and use one or more of the available options:
30-
31-
- **Script**: Filter scripts by their URL.
32-
- **Connection**: Filter connections by their target URL. Depending on your [configuration](/page-shield/reference/settings/#connection-target-details), it may search only by target hostname.
33-
- **Host**: Look for scripts appearing on specific hostnames, or connections made in a specific hostname.
34-
- **Page** (requires a Business or Enterprise plan): Look for scripts appearing in a specific page, or for connections made in a specific page. Searches the first page where the script was loaded (or where the connection was made) and the latest occurrences list.
31+
3. Review the list of scripts, connections, and cookies for your domain. To apply a filter, select **Add filter** and use one or more of the available options:
32+
- **Script URL**: Filter scripts by their URL.
33+
- **Connection URL**: Filter connections by their target URL. Depending on your [configuration](/page-shield/reference/settings/#connection-target-details), it may search only by target hostname.
34+
- **Seen on host**: Look for scripts appearing on specific hostnames, or connections made in a specific hostname.
35+
- **Seen on page** (requires a Business or Enterprise plan): Look for scripts appearing in a specific page, or for connections made in a specific page. Searches the first page where the script was loaded (or where the connection was made) and the latest occurrences list.
3536
- **Status**: Filter scripts or connections by [status](/page-shield/reference/script-statuses/).
3637
- **Type**: Filter cookies according to their type: first-party cookies or unknown.
3738
- Cookie property: Filter by a cookie property such as **Name**, **Domain**, **Path**, **Same site**, **HTTP only**, and **Secure**.
@@ -40,12 +41,15 @@ To review the resources and cookies detected by Page Shield:
4041

4142
## View all reported scripts or connections
4243

43-
The All Reported Connections and All Reported Scripts dashboards show all the detected resources including infrequent or inactive ones, reported in the last 30 days. After 30 days without any report, Page Shield will delete information about a previously reported resource, and it will no longer appear in any of the dashboards.
44+
The All Reported Connections and All Reported Scripts dashboards show all the detected resources including infrequent or inactive ones, reported in the last 30 days. After 30 days without any report, Cloudflare will delete information about a previously reported resource, and it will no longer appear in any of the dashboards.
4445

4546
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
46-
2. Go to **Security** > **Page Shield** > **Monitors**.
47+
2. Go to the client-side resources page:
48+
- Old dashboard: Go to **Security** > **Page Shield**.
49+
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
50+
4751
3. Select **Scripts** or **Connections**.
48-
4. Select **View all**.
52+
4. Select **View all scripts** or **View all connections**.
4953
5. Review the information displayed in the dashboard.
5054

5155
You can filter the data in these dashboards using different criteria, and print a report with the displayed records.
@@ -77,7 +81,6 @@ The script details also include the last 10 script versions detected by Page Shi
7781
The details of each cookie include:
7882

7983
- **Type**: A cookie can have the following types:
80-
8184
- **First-party**: Cookies set by the origin server through a `set-cookie` HTTP response header.
8285
- **Unknown**: All other detected cookies.
8386

@@ -113,6 +116,11 @@ Use this feature to extract data from Page Shield that you can review and annota
113116

114117
To export script, connection, or cookie information in CSV format:
115118

116-
1. Go to the **Monitors** tab and select **Scripts**, **Connections**, or **Cookies**.
117-
2. (Optional) Apply any filters to the displayed data.
118-
3. Select **Download CSV**.
119+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
120+
2. Go to the client-side resources page:
121+
- Old dashboard: Go to **Security** > **Page Shield**.
122+
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
123+
124+
3. Select **Scripts**, **Connections**, or **Cookies**.
125+
4. (Optional) Apply any filters to the displayed data.
126+
5. Select **Download CSV**.

src/content/docs/page-shield/detection/review-changed-scripts.mdx

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,16 @@ description: Learn how to review scripts on your domain after receiving a code c
1111
Available as a paid add-on for customers on an Enterprise plan.
1212
:::
1313

14-
Page Shield analyzes the JavaScript dependencies in the pages of your domain over time.
14+
Cloudflare analyzes the JavaScript dependencies in the pages of your domain over time.
1515

1616
You can configure a notification for [code change alerts](/page-shield/alerts/alert-types/#code-change-alert) to receive a daily notification about changed scripts in your domain.
1717

1818
When you receive such a notification:
1919

2020
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
21-
2. Go to **Security** > **Page Shield** > **Monitors**.
21+
2. Go to the client-side resources page:
22+
23+
- Old dashboard: Go to **Security** > **Page Shield**.
24+
- New security dashboard: Go to **Security** > **Web assets** > **Client-side resources** tab.
25+
2226
3. Check the details of each changed script and validate if it is an expected change.

0 commit comments

Comments
 (0)