diff --git a/src/content/docs/page-shield/how-it-works/index.mdx b/src/content/docs/page-shield/how-it-works/index.mdx index d89e229e458566e..2c89cf63f14fc33 100644 --- a/src/content/docs/page-shield/how-it-works/index.mdx +++ b/src/content/docs/page-shield/how-it-works/index.mdx @@ -18,7 +18,7 @@ Enabling Page Shield adds a Content Security Policy (CSP) report-only directive to gather a list of all scripts running on your application. @@ -34,7 +38,7 @@ is required to enable inline execution. You can safely ignore these warnings, since they are related to the reports that Page Shield requires to detect loaded scripts. For more information, refer to [How Page Shield works](/page-shield/how-it-works/). -## Why do I get policy violation reports for a domain I allowlisted? +## I get policy violation reports for a domain I allowlisted Policy violations reported via CSP's [report-only directive](/page-shield/reference/csp-header/) do not take into consideration any redirects or redirect HTTP status codes. This is [by design](https://www.w3.org/TR/CSP3/#create-violation-for-request) for security reasons. @@ -43,11 +47,3 @@ Some third-party services you may want to cover in your Page Shield allow polici For example, if you add the `adservice.google.com` domain to an allow policy, you could get policy violation reports for this domain due to redirects to a different domain (not present in your allow policy). In this case, the violation report would still mention the original domain, and not the domain of the redirected destination, which can cause some confusion. To try to solve this issue, add the domain of the redirected destination to your allow policy. You may need to add several domains to your policy due to redirects. - -## Do I have access to Page Shield? - -Yes, Page Shield is available on all plans. For details on the available features per plan, refer to [Availability](/page-shield/#availability). - -### How do I set up Page Shield? - -For help setting up Page Shield, refer to our [get started guide](/page-shield/get-started/).