demo: page shield — client-side script visibility + csp
page shield watches the third-party scripts your visitors' browsers actually load, and reports them back to cloudflare. it's the answer to "what javascript is running in my users' browsers, and did any of it change without my knowledge." also generates a recommended csp based on observed real traffic.
# scripts loaded on this page
to give page shield something to see, this page loads a tiny script
from cdn.jsdelivr.net. it doesn't do anything, it just
exists so it shows up in the page shield inventory.
# where to look
| page shield status | enabled zone-wide · uses cloudflare reporting endpoint |
| dashboard path | zone → security → page shield → scripts |
| expected findings | after some real visits: challenges.cloudflare.com, cdn.jsdelivr.net, any inline scripts |
# csp policy recommendation
page shield builds a candidate content-security-policy based on what it has actually observed loading. dashboard path: zone → security → page shield → policies → suggested policies. you copy the recommended csp into a response-header transform rule and deploy.
the "sales value" is that page shield removes the guesswork from csp — you don't have to enumerate every third-party script by hand and then play whack-a-mole with report-only mode.
# what real traffic reveals
- every script src, inline script, and their hashes
- whether a script changed between visits (magecart / supply-chain signal)
- connections initiated by scripts (fetch, xhr, websocket endpoints)
- page shield alerts you can pipe into slack / pagerduty