Cloudflare Page Shield vs Proteside: script monitoring from the edge, or checking the payment on screen?
By Laís Peixoto
Growth Marketer, Proteside
Published
Cloudflare Client-Side Security, known as Page Shield until March 2026, monitors scripts, connections and cookies on sites proxied through Cloudflare, with nothing to install. Proteside is one line of code on any checkout that checks, in every session, whether the QR code, wallet address and card fields on screen match what the merchant issued.
Side by side
- How it describes itself
- A client-side security feature inside the Cloudflare platform. Page Shield until 25 March 2026, Client-Side Security since then; the advanced package is called Client-Side Security Advanced.
- Headquarters
- San Francisco, United States. The founding year is not stated on the company page consulted.
- How it enters the site
- No script of its own. The Cloudflare proxy adds a report-only CSP header to a sample of HTML responses and builds the inventory from the reports browsers send back. Requires the site's traffic to be proxied through Cloudflare.
- What it checks on the payment page
- Scripts, the connections they open and cookies, with the page where each resource first appeared. Malicious script detection and code change detection in the advanced package.
- PCI DSS
- The documentation says the feature can be used for requirements 6.4.3 and 11.6.1 and that Client-Side Security Advanced is required for that. A PCI SSC listing is not mentioned in the sources consulted.
Cloudflare Client-Side Security (antes Page Shield)
- How it describes itself
- Cybersecurity layer for the moment of payment: integrity of what the buyer sees, copies and confirms.
- Headquarters
- São Paulo, Brazil. Operating since 2026.
- How it enters the site
- One line of code on the payment page, or an integration in the platform or payment provider template. No proxy, no DNS or CDN change.
- What it checks on the payment page
- Third-party scripts, card form, Pix QR code and key, boleto (Brazilian bank slip) line, crypto wallet address and the QR codes of eight instant payment rails, matched against what the merchant issued.
- PCI DSS
- Evidence for PCI DSS requirements 6.4.3 and 11.6.1, with an exportable report for the QSA.
Proteside
Criterion by criterion
Marks are based on each vendor's public documentation. Hover over or tap a mark to read the legend.
| Cloudflare Page Shield | Proteside | |
|---|---|---|
| What is checked on the payer's screen | ||
| Inventory and authorization of scripts on the payment pageThe basis of requirement 6.4.3: know what runs on the page and authorize each script. | Described with a limitation (optional, sampled, requires human action or only in one product tier)1 | Described in public documentation |
| Card details typed into the formStop a script from copying the number, expiry date and security code. | Described with a limitation (optional, sampled, requires human action or only in one product tier)2 | Described in public documentation |
| Pix QR code and copy-and-paste code (Brazil)Brazil's most common checkout scam: the QR code shown leads to another account. | Not found in public information | Described in public documentation |
| Boleto (Brazilian bank slip) payment lineA swapped line pays a different payee for the same amount. | Not found in public information | Described in public documentation |
| QR codes of instant payment rails worldwide (UPI, PayNow, DuitNow, PromptPay, QR Ph, FPS, CoDi, Transferencias 3.0)The same swap as Pix, across eight instant payment systems. | Not found in public information | Described in public documentation |
| Stablecoin and crypto wallet address, including when copiedA wallet address swapped on screen or in the clipboard is irreversible. | Not found in public information | Described in public documentation |
| Matches what is on screen against what the merchant issued and blocks the swap before confirmationThe check that defines payment integrity: payee and amount equal to what was issued. | Not found in public information | Described in public documentation |
| How it protects | ||
| Blocks unauthorized scripts in the buyer's browserDetecting after the fact does not bring the copied data back. | Described with a limitation (optional, sampled, requires human action or only in one product tier)3 | Described in public documentation |
| Watches real buyer sessionsTargeted scams do not show up in simulated visits. | Described with a limitation (optional, sampled, requires human action or only in one product tier)4 | Described in public documentation |
| Works without changing CDN, DNS or proxyDrops into any platform with one line of code. | The vendor states it does not do this5 | Described in public documentation |
| PCI DSS compliance | ||
| Evidence for PCI DSS requirement 6.4.3Inventory, authorization and integrity of scripts. | Described with a limitation (optional, sampled, requires human action or only in one product tier)6 | Described in public documentation |
| Evidence for PCI DSS requirement 11.6.1Unauthorized changes to the page and its headers. | Described with a limitation (optional, sampled, requires human action or only in one product tier)7 | Described in public documentation |
| Exportable report for the assessor (QSA)Evidence has to leave the dashboard and reach the assessment. | Not found in public information | Described in public documentation |
- Described in public documentation
- Described with a limitation (optional, sampled, requires human action or only in one product tier)
- Not found in public information
- The vendor states it does not do this
Notes on the marks
- 1Inventory and authorization of scripts on the payment page: The documentation describes the inventory as built from a report-only CSP header added to a sample of HTML responses, and warns that a newly deployed script may take a while to show up in the dashboard.
- 2Card details typed into the form: The public material covers scripts, connections and cookies observed through browser reports. A check of the card form itself, in the buyer's browser, is not described.
- 3Blocks unauthorized scripts in the buyer's browser: The monitoring header is report-only and, in the documentation's own words, does not block anything. Blocking comes from content security rules in allow mode, available in the advanced package, with a limit of five rules.
- 4Watches real buyer sessions: Reports come from real browsers, but only from the sample of responses that received the header; the documentation does not describe coverage of every session.
- 5Works without changing CDN, DNS or proxy: The official blog states that the only prerequisite is that traffic is proxied through Cloudflare. Sites on another CDN, or with no proxy, are out of scope.
- 6Evidence for PCI DSS requirement 6.4.3: The PCI DSS reference page says the feature can be used for requirement 6.4.3 and that Client-Side Security Advanced is required.
- 7Evidence for PCI DSS requirement 11.6.1: The same page lists requirement 11.6.1 under the same condition: advanced package only. How evidence is handed to the assessor is not described on the page consulted.
Where Cloudflare Page Shield stands out
Nothing to deploy for sites already on Cloudflare
Monitoring is switched on in the Cloudflare dashboard and starts collecting browser reports without touching the site's code, according to the official blog.
Scripts, connections and cookies in one inventory
Beyond scripts, the documentation describes recording the connections those scripts open and the cookies crossing the proxy, with the page where each resource was first seen.
Threat intelligence plus a language model for detection
Since 3 March 2026, suspicious scripts are analysed with a language model running on Workers AI to cut false positives; Cloudflare states that customer data is not used to train those models.
Enforcement at the edge, without code
In the advanced package, content security rules become an enforcing CSP header that blocks anything outside the allowlist, applied to every response the rule matches.
What Proteside checks that the Cloudflare documentation does not mention
A tutoring marketplace in Bangalore collects by UPI. The parent taps Pay, a QR code appears, they scan it with their banking app and the money leaves in seconds. If a browser extension or a compromised theme plugin swapped that QR for one pointing at another account, same amount, the payment goes through, the order never settles, and no new script appeared on the page. To a script inventory, the page looks unchanged.
Client-Side Security watches the scripts, connections and cookies crossing the proxy, and the documentation describes that clearly. UPI, PromptPay or PayNow QR codes, USDT wallet addresses and Brazilian bank slips (boleto) do not appear in the public material. Proteside records what the merchant's server issued for each charge and compares it with what the buyer sees, copies and confirms, in every session rather than a sample. On a mismatch, confirmation is blocked and the attempt is logged as an alert and as evidence.
The same script also inventories third-party scripts, watches the card form and keeps the change history that requirements 6.4.3 and 11.6.1 call for. A site behind Cloudflare keeps its edge exactly as it is and adds the payment check on the checkout page.
How each one enters the operation
Cloudflare Page Shield
- Enabled in the Cloudflare dashboard, for domains whose traffic already goes through the Cloudflare proxy.
- Report-only CSP header on a sample of responses; the header cannot be switched off while monitoring is on.
- Content security rules in the advanced package to enforce an allowlist; alerts and log export through the platform itself.
Proteside
- One line of code on the payment page, on any platform and behind any CDN, Cloudflare included.
- Checks in every session, with no sampling and no waiting for a new script to surface.
- Automatic blocking before confirmation; dashboard, API and alerts by email, Slack, Teams and webhook.
When to choose each one
Cloudflare Page Shield makes sense when
- The site already runs through Cloudflare, cards are the payment method and your assessor accepts an inventory built by sampling.
- You want visibility of scripts, connections and cookies across the whole domain, not only the checkout, without adding code.
- Your team already manages security rules in Cloudflare and prefers to enforce the allowlist from the edge.
Proteside makes sense when
- The checkout takes UPI, PromptPay, PayNow, DuitNow, FPS, stablecoins or Brazilian Pix and boleto.
- You need the beneficiary swap blocked in the session where it happens, for every buyer.
- The site is not proxied through Cloudflare, or you want the same protection across stores spread over several CDNs.
Both together
A good share of Proteside customers already use Cloudflare at the edge for DNS, caching and attack mitigation. In that setup, Client-Side Security keeps building the domain-wide inventory from the proxy, and Proteside checks the payment on the checkout page, session by session. The two do not compete for the same job and do not interfere with each other.
Frequently asked questions
Does Cloudflare Page Shield cover Pix, boleto or QR codes?
Not in the public information consulted in October 2026. The Client-Side Security documentation describes scripts, connections, cookies and code changes; payment data shown on screen, such as a UPI or PromptPay QR code, is not mentioned.
Can I use Cloudflare Page Shield and Proteside together?
Yes, and that is the most common setup among Proteside customers on Cloudflare. Proteside is one script on the payment page and shows up in the Cloudflare inventory like any other authorised resource.
Are Page Shield and Client-Side Security the same product?
Yes. On 25 March 2026 Cloudflare renamed Page Shield to Client-Side Security, and the add-on became Client-Side Security Advanced. The release notes say the features and entitlements did not change with the name.
Do I need to be on Cloudflare to use Client-Side Security?
Yes. The official blog says the only prerequisite is that your traffic is proxied through Cloudflare, because the monitoring header is added to responses at the edge.
Why does a new script take time to appear in the Cloudflare dashboard?
The documentation explains it: the report-only header goes on a sample of responses, and the inventory depends on the reports browsers send back. That leaves a gap between deploying a script and seeing it listed.
See Proteside checking your checkout
Fourteen days free, one line of code, every payment method on your page.