Page Shield expands to track outbound connections from third-party scripts

Third-party JavaScript powers much of the modern web — checkout flows, analytics, live chat. But every script you embed is also a potential channel for your visitors' data to leave your site, often without your knowledge. Cloudflare's Page Shield now includes Connection Monitor, which gives website operators visibility into exactly where those outbound connections are headed.

Page Shield is Cloudflare's client-side security offering, designed to catch malicious behavior in the browser environment — particularly compromises that exploit flaws in third-party JavaScript libraries. Connection Monitor, launching today, adds a new lens: instead of only analyzing script code, it tracks the destinations of browser-initiated connections made by third-party JavaScript running on your pages.

Connection Monitor is available to customers on Business and Enterprise plans. On the Enterprise Page Shield add-on, you also receive notifications when a connection is flagged as potentially malicious.

Why connection-level visibility matters

Before Connection Monitor, Page Shield's Script Monitor focused on analyzing JavaScript code for malicious signals. Connection Monitor complements that by examining where data is being transmitted. The two features work in tandem, and that combination addresses a common failure mode: client-side compromises that lead to data exfiltration without altering the user experience.

Magecart-style attacks are the canonical example. An attacker injects code into a third-party widget or script on an e-commerce site, then intercepts credit card details directly from the checkout flow — all without changing how the site appears or behaves. These attacks often go unnoticed because they run inside scripts outside your direct control and produce no visible effect.

Working alongside Content Security Policies

Page Shield relies on Content Security Policies (CSPs) to gather data from browsers, but its purpose differs from CSP's typical deployment. CSP lets administrators dictate what the browser may load and from where. In practice, CSPs are notoriously difficult to maintain for large applications and frequently end up overly broad, which undercuts their effectiveness. More fundamentally, CSP has no built-in mechanism for detecting malicious behavior.

That's where Page Shield steps in. With Script Monitor, Cloudflare already ran its classifier against JavaScript code. Connection Monitor adds threat intelligence feed lookups against connection URL endpoints, enabling rapid identification of potentially suspicious data leaks.

How Connection Monitor works under the hood

Connection Monitor uses the CSP connect-src directive to receive outbound connection information from browsers. The data is stored and enriched with context: connection status, the page that initiated the connection, domain information, and — for the Enterprise add-on — threat feed intelligence.

To use Connection Monitor, your application must be proxied through Cloudflare. When enabled, Cloudflare injects the following HTTP response header on a sampled percentage of HTML page loads:

content-security-policy-report-only: script-src 'none'; connect-src 'none'; report-uri <HOSTNAME>/cdn-cgi/script_monitor/report?<QUERY_STRING>

This header instructs the browser to report script and connection activity to the given endpoint. By default, the endpoint hostname is csp-reporting.cloudflare.com; Enterprise add-on customers can change it to match their own site's hostname.

Using this CSP, browsers report connections initiated via:

  • <a> ping
  • fetch()
  • XMLHttpRequest
  • WebSocket
  • EventSource
  • Navigator.sendBeacon()

From these reports, Cloudflare builds an inventory of outbound connection URLs and the pages that initiated them. That inventory is available in the dashboard, enriched with connection status, first/last seen timestamps, WHOIS and SSL certificate metadata, domain registration details, and malicious signals from threat feed domain and URL lookups (URL lookups require full connection paths to be stored).

Privacy by default

Connection Monitor defaults to storing only the scheme and host portion of a connection URL. For an endpoint like https://connection.example.com/session/abc, it keeps https://connection.example.com and discards the path /session/abc. This minimizes the risk of collecting session IDs or other sensitive data that might appear in full URLs.

The trade-off is that without the path, full URL feed lookups against threat intelligence aren't possible in some cases. If you're confident your connection paths don't contain sensitive data, you can enable path storage from the dashboard. Domain lookups continue to operate regardless. Query string storage is planned for a future release.

Looking ahead, Cloudflare says Script Monitor and Connection Monitor are just two of several CSP directives it plans to support in Page Shield. The roadmap includes proposing and implementing both positive and negative CSP policies directly from the dashboard.