Client-side attacks get a new line of defense

Supply chain attacks are a persistent worry for security teams. In this model, an attacker compromises a third-party tool or library that the target application depends on, often gaining privileged access to the environment and enabling data theft or follow-on attacks. A well-known example is Magecart, which injects skimming code into e-commerce checkout flows by compromising the third-party libraries those sites rely on.

Cloudflare is now making Page Shield generally available, a product aimed at identifying and mitigating these kinds of attacks in web applications. Page Shield gives you visibility into the scripts running on your site and can alert you when they show signs of compromise or malicious behavior, such as attempts to exfiltrate user data. It lives under the Firewall tab and switches on with a single click, no extra configuration required. Alerts are configured separately and can cover a range of events.

Page Shield’s approach stems from Cloudflare’s position as a reverse proxy: it receives information from browsers about which JavaScript files and modules are being loaded, then provides visibility, analysis, and warnings when a file behaves maliciously. This matters because the bulk of modern apps rely on JavaScript from third parties that are outside the application owner's control.

Why client-side security is hard

Data from Page Shield’s early access shows that a typical application loads scripts from an average of eight third-party hosts. Those hosts range from large enterprises like Google to small providers offering plug-and-play modules for features like chat systems, date pickers, and checkout platforms. Each one is a potential supply chain attack target, making the attack surface large and hard to monitor.

The surface is also dynamic. Around 50% of applications load scripts from new third-party hosts every month, meaning the set of trusted origins is constantly shifting.

How Page Shield works

Page Shield can be understood in terms of visibility, detection, mitigation, and prevention. The first step is visibility.

Once enabled, the current iteration uses a content security policy (CSP) deployed with a report-only directive. The CSP header instructs the browser to load no scripts (script-src 'none') and to report every violation to an endpoint on the Cloudflare network (report-uri /cdn-cgi/script_monitor/report). The reports are HTTP POST requests that include details such as the document the script was loaded from (document-uri), the violated directive, the full CSP, the JavaScript file’s URL, and the HTTP response code the browser received when loading the file (200 in the example, indicating successful load).

Page Shield aggregates these reports and augments them with extra data to give you a per-script breakdown, viewable through the Cloudflare dashboard or the API. Script reports are available to all zones on the Pro plan. Business and Enterprise zones get page attribution, letting you see exactly where within an app a script came from, and they can set up alerts on a variety of script change events.

Detecting malicious behavior

CSPs alone are often too permissive, and browsers lack native mechanisms for detecting malicious behavior in JavaScript files that are permitted by policy. Page Shield is meant to fill that gap by analyzing files in a few distinct ways:

  • Scripts loaded from hostnames or URLs classified as malicious in corporate threat feeds are flagged, including cases involving the parent domain.
  • If a specific URL is categorized as malicious, an attack is likely underway, and the file gets flagged accordingly.
  • Files are downloaded and passed through a classifier that applies deobfuscation, normalization, and decoding, then looks for correlations between form field fetches and data exfiltration calls. A stronger correlation means a higher probability the script is executing a Magecart-style attack.

Enterprise customers can opt into the full detection feature set. Once a file triggers, Cloudflare can notify you through email, webhook, PagerDuty, or other channels.

Prevention and mitigation on the roadmap

Although not included in the initial release, Cloudflare is building out two additional capabilities. The first is prevention through easy CSP generation based on observed active scripts, with editing and redeployment support through the dashboard or API as part of a deployment pipeline. The second is blocking, which will use Cloudflare’s proxy to strip malicious scripts from HTTP response bodies inline.

Planned work for next year also covers additional detection signals and expansion of the classifier to catch more attack types, including adware, ransomware, and crypto mining.

Getting started

Sites already on Cloudflare can upgrade to a paid plan to use Page Shield features without further configuration. For those not yet on the platform, sign-up takes only a few minutes. API access is available for managing Page Shield programmatically.