Page Shield sharpens script alerts for faster triage
Page Shield, Cloudflare's client-side protection layer, has been updated to surface the scripts that matter most and provide the context security teams need to decide whether an alert is worth acting on. The new version refines how script activity is reported, expands the metadata shown for malicious scripts, and breaks down the scoring that labels a script as bad.
A cleaner script inventory
Page Shield monitors JavaScript loaded by end-user browsers via Content Security Policy (CSP) violation reports, keeping a watch on scripts across all of a zone's pages. The dashboard view now defaults to active scripts only — defined as anything seen in the last seven days and not served by Cloudflare's own cdn-cgi endpoint. Previously, admins had to wade through everything Page Shield observed, including noise from browser extensions and stale entries.
Alongside active, Page Shield now classifies scripts with additional statuses:
infrequent— Seen only in a negligible number of CSP reports over time, often pointing to a compromised browser extension on a single user's machine.inactive— No reports for seven days, suggesting removal or replacement.cdn-cgi— Served from Cloudflare's managed/cdn-cgi/endpoint, related to products like analytics or Bot Management. These are closely monitored and, being fairly static, are hidden by default unless suspicious activity is found.
Admins who want the complete picture can still switch to an "All scripts" view, but the default behavior is now focused on scripts requiring attention.
Alert context that explains the "why"
For enterprise add-on customers, the notification payload for malicious scripts has been expanded well beyond a bare URL. The top of the alert now shows where the script was seen, when it was seen, and the full URL (deliberately left non-clickable to reduce risk). Below that, context is grouped for a security analyst's workflow.
One common pain point — the "why did it score this way?" question — is addressed by decomposing the machine learning score. Instead of a single opaque number, alerts now show the contributing components, currently obfuscation and data exfiltration values. This aids review of false positives. Threat-feed categorizations are also included, with labels such as malware, spyware, and phishing applied when feeds classify an endpoint.
Script change history is now exposed along with the malicious-code score for each version reviewed.
Domain ownership context follows, with WHOIS details on the party hosting the script. Registrar-level data like registration and expiration dates can reveal suspicious changes — for instance, malicious scripts commonly sit behind freshly registered domains.
SSL certificate issuance is now tracked via certificate transparency monitoring. A shift in certificate issuer — say, a Digicert certificate replaced by one from Let's Encrypt — can be a signal of a possible domain takeover attempt.
The alert ends with a direct dashboard link into the specific script's details page, removing the need to manually navigate the UI.
Roadmap: CSP generation, permission blocking
Cloudflare is building attack-type-specific detectors as a complement to existing anomaly tools. A planned component targets connect-src CSP directive endpoints for signs of malicious intent, aiming to improve Magecart-style attack detection accuracy. Also in progress are features to generate CSP policies directly from Page Shield, a one-click permission block for webcam, microphone, and location access, and related capabilities that will roll out in future releases.
