Akamai Client-Side Protection vs Proteside: CDN edge or payment check?
By Laís Peixoto
Growth Marketer, Proteside
Published
Akamai Client-Side Protection & Compliance inventories the scripts on a payment page, scores their behavior in real user sessions and lets your team restrict a script from the Akamai console. Proteside keeps that inventory and checks, in the shopper's browser, that the QR code, bank slip line or wallet address match what the merchant issued, blocking a swap before confirmation.
Side by side
- How it describes itself
- Akamai's security product for threats that act in the customer's browser: script inventory, behavior analysis and PCI DSS compliance on payment pages.
- Headquarters
- Cambridge, Massachusetts, United States. Renamed from Page Integrity Manager to Client-Side Protection & Compliance in October 2023.
- How it enters the site
- Detection script injected by the Akamai edge as the first resource on the page, or placed at the origin. The share of page views that receive the script is set in Akamai Control Center.
- What it checks on the payment page
- Scripts observed on the payment page (source, behavior, data destinations), with predefined justifications, risk scores and threat intelligence; changes to HTTP headers and payment page protections.
- PCI DSS
- Requirements 6.4.3 and 11.6.1 cited on the product page, with dedicated PCI alerts and an audit dashboard. A named report for the QSA is not described in the public material.
Akamai Client-Side Protection & Compliance (antes Page Integrity Manager)
- How it describes itself
- Cybersecurity layer for the moment of payment: integrity of what the buyer sees, copies and confirms.
- Headquarters
- São Paulo, Brazil. Operating since 2026.
- How it enters the site
- One line of code on the payment page, or an integration in the platform or payment provider template. No proxy, no DNS or CDN change.
- What it checks on the payment page
- Third-party scripts, card form, Pix QR code and key, boleto (Brazilian bank slip) line, crypto wallet address and the QR codes of eight instant payment rails, matched against what the merchant issued.
- PCI DSS
- Evidence for PCI DSS requirements 6.4.3 and 11.6.1, with an exportable report for the QSA.
Proteside
Criterion by criterion
Marks are based on each vendor's public documentation. Hover over or tap a mark to read the legend.
| Akamai Client-Side Protection | Proteside | |
|---|---|---|
| What is checked on the payer's screen | ||
| Inventory and authorization of scripts on the payment pageThe basis of requirement 6.4.3: know what runs on the page and authorize each script. | Described in public documentation | Described in public documentation |
| Card details typed into the formStop a script from copying the number, expiry date and security code. | Described with a limitation (optional, sampled, requires human action or only in one product tier)1 | Described in public documentation |
| Pix QR code and copy-and-paste code (Brazil)Brazil's most common checkout scam: the QR code shown leads to another account. | Not found in public information | Described in public documentation |
| Boleto (Brazilian bank slip) payment lineA swapped line pays a different payee for the same amount. | Not found in public information | Described in public documentation |
| QR codes of instant payment rails worldwide (UPI, PayNow, DuitNow, PromptPay, QR Ph, FPS, CoDi, Transferencias 3.0)The same swap as Pix, across eight instant payment systems. | Not found in public information | Described in public documentation |
| Stablecoin and crypto wallet address, including when copiedA wallet address swapped on screen or in the clipboard is irreversible. | Not found in public information | Described in public documentation |
| Matches what is on screen against what the merchant issued and blocks the swap before confirmationThe check that defines payment integrity: payee and amount equal to what was issued. | Not found in public information | Described in public documentation |
| How it protects | ||
| Blocks unauthorized scripts in the buyer's browserDetecting after the fact does not bring the copied data back. | Described with a limitation (optional, sampled, requires human action or only in one product tier)2 | Described in public documentation |
| Watches real buyer sessionsTargeted scams do not show up in simulated visits. | Described in public documentation | Described in public documentation |
| Works without changing CDN, DNS or proxyDrops into any platform with one line of code. | Described with a limitation (optional, sampled, requires human action or only in one product tier)3 | Described in public documentation |
| PCI DSS compliance | ||
| Evidence for PCI DSS requirement 6.4.3Inventory, authorization and integrity of scripts. | Described in public documentation | Described in public documentation |
| Evidence for PCI DSS requirement 11.6.1Unauthorized changes to the page and its headers. | Described in public documentation | Described in public documentation |
| Exportable report for the assessor (QSA)Evidence has to leave the dashboard and reach the assessment. | Not found in public information4 | Described in public documentation |
- Described in public documentation
- Described with a limitation (optional, sampled, requires human action or only in one product tier)
- Not found in public information
- The vendor states it does not do this
Notes on the marks
- 1Card details typed into the form: Akamai's product page describes detecting scripts that access and exfiltrate sensitive data in real sessions and restricting those scripts "with one click". Blocking therefore depends on a person acting in the console after the alert.
- 2Blocks unauthorized scripts in the buyer's browser: Mitigation is described as restricting malicious scripts "with one click" in Akamai Control Center. Policies can be created for recurring threats; automatic blocking of a newly seen script inside a live session is not described in the public material.
- 3Works without changing CDN, DNS or proxy: The documentation says detections apply to any website, wherever it is hosted, and that the script can be placed at the origin. The security policy, the injection percentage and incident handling live in Akamai Control Center.
- 4Exportable report for the assessor (QSA): The public material cites an audit dashboard and dedicated PCI alerts for producing evidence. An exportable report for the QSA, under that name, is not described in the sources checked.
Where Akamai Client-Side Protection stands out
Behavior analysis in real sessions
The product page describes continuous analysis of what each script executes in real user browsers, machine learning to score the risk of unauthorized actions, and checks of script URLs against known vulnerabilities.
Edge injection ahead of every other script
When the page is delivered through Akamai, the detection script loads first and synchronously. The documentation states the page cannot avoid it, which makes it hard for a malicious script to run before detection does.
Fine control over where the script goes
You can set a percentage of page views, force or exclude specific paths such as sensitive forms, and switch injection on or off per request with test parameters before widening coverage.
No collection of what the shopper types
The public material states the product does not collect form input, page text or payment data; it records script behavior only.
What Proteside checks that Akamai's material does not mention
A Bengaluru electronics store takes a 38,000 rupee order over UPI. The shopper taps pay, scans the QR code with a banking app and approves. A review widget updated the night before has redrawn the QR code with the same amount and a different payee ID. No card number left the page; the money simply landed in someone else's account, and the store finds out when the order never reconciles.
Client-Side Protection & Compliance watches what scripts do and where they send data, which covers card data theft well. The UPI QR code, a PromptPay or PayNow code, a Brazilian bank slip line or a USDT wallet address do not appear in Akamai's public documentation as data that gets verified. Proteside records what your server issued for each charge (code, address, amount) and compares it with what the shopper sees and copies, in every session. When the two differ, the confirmation is blocked and the attempt is logged as an alert and as evidence.
The same installation inventories the page's scripts, protects the credit card form and the debit card form, and keeps the change history that requirements 6.4.3 and 11.6.1 call for. Blocking happens in the shopper's browser, with no wait for someone to approve a restriction.
How each one enters your operation
Akamai Client-Side Protection
- Detection script injected by the Akamai edge as the first resource on the page, or installed at the origin.
- Percentage of page views that receive the script set in the security policy; the documentation recommends starting small and working up to 100%.
- Behavior data sent to Akamai's servers before the user leaves the page; incidents handled in Akamai Control Center.
Proteside
- One line of code on the payment page, on any platform or CDN, or a single integration in the payment provider's template.
- Every session checked, with no sampling percentage to configure.
- A swapped QR code, ID, bank slip line or wallet address is blocked before confirmation; dashboard, API and alerts by email, Slack, Teams and webhook.
When to choose each one
Akamai Client-Side Protection makes sense when
- Your site is already delivered through Akamai and your security team runs policies in Akamai Control Center.
- You want threat intelligence from the Akamai network, risk scores and known-vulnerability checks on the scripts of your page.
- Your change process requires a person to approve restricting a script before it takes effect, with a record of who decided.
Proteside makes sense when
- Your checkout takes UPI, PromptPay, PayNow, DuitNow, FPS, Pix, Brazilian bank slips or stablecoins, and the risk is a swapped payee.
- You need the swap blocked in every session, without sampling and without waiting for a click.
- Your site does not run on Akamai and you want protection plus evidence for requirements 6.4.3 and 11.6.1 from one line of code.
Both together
A team that already runs Client-Side Protection & Compliance at the edge can keep it for threat intelligence and console-managed inventory, and add Proteside on the payment page to verify the QR code, payee ID, bank slip line and wallet address. Proteside's script does not interfere with Akamai's injection or with the data it sends back to Akamai.
Frequently asked questions
Does Akamai Client-Side Protection cover UPI, PromptPay or QR code payments?
Not in the public information checked in October 2026. Akamai's site and documentation describe scripts, sensitive data accessed by scripts, HTTP headers and payment page protections.
Can Akamai Client-Side Protection and Proteside be used together?
Yes. Akamai's script arrives through the edge or the origin; Proteside's arrives as one line on the payment page. Each keeps its own inventory, and Proteside neither alters legitimate payments nor blocks Akamai's script.
Does my site have to be delivered through Akamai to use Client-Side Protection & Compliance?
According to the public documentation, no: detections apply to any website and the script can be placed at the origin. The security policy, the injection percentage and incident handling stay in Akamai Control Center.
What does the page-view percentage mean for coverage?
The documentation lets you inject the script into a random share of page views and recommends starting small and reaching 100%. Below 100%, some shoppers load the page without the detection script. Proteside checks every session, with no such setting.
Are Page Integrity Manager and Client-Side Protection & Compliance the same product?
Yes. Akamai renamed Page Integrity Manager to Client-Side Protection & Compliance in October 2023; the technical documentation still lives at the old address.
See Proteside checking your checkout
Fourteen days free, one line of code, every payment method on your page.