F5 Client-Side Defense vs Proteside: mitigation lists or automatic blocking at the moment of payment?
By Laís Peixoto
Growth Marketer, Proteside
Published
F5 Distributed Cloud Client-Side Defense inventories the scripts on your application and alerts on suspicious domains and sensitive field reads, with mitigation your team defines through lists in the F5 console. Proteside checks, in the shopper's browser, that the QR code, account details, wallet address and card fields match what the merchant issued, and blocks a swap automatically.
Side by side
- How it describes itself
- A service within F5 Distributed Cloud Services that lists the scripts running on a web application and alerts on sensitive data reads, with user-defined mitigation.
- Headquarters
- Seattle, United States (F5, Inc.).
- How it enters the site
- Script inserted by an F5 Distributed Cloud HTTP load balancer, or placed manually through a CMS, CDN, load balancer or BIG-IP; management lives in the Distributed Cloud console.
- What it checks on the payment page
- First-, third- and fourth-party scripts, form field reads, destination domains, new scripts, behavior changes and header changes.
- PCI DSS
- Public material cites PCI DSS and telemetry for audit trails. A named QSA report and a declared PCI SSC affiliation are not listed.
F5 Distributed Cloud Client-Side Defense
- How it describes itself
- Cybersecurity layer for the moment of payment: integrity of what the buyer sees, copies and confirms.
- Headquarters
- São Paulo, Brazil. Operating since 2026.
- How it enters the site
- One line of code on the payment page, or an integration in the platform or payment provider template. No proxy, no DNS or CDN change.
- What it checks on the payment page
- Third-party scripts, card form, Pix QR code and key, boleto (Brazilian bank slip) line, crypto wallet address and the QR codes of eight instant payment rails, matched against what the merchant issued.
- PCI DSS
- Evidence for PCI DSS requirements 6.4.3 and 11.6.1, with an exportable report for the QSA.
Proteside
Criterion by criterion
Marks are based on each vendor's public documentation. Hover over or tap a mark to read the legend.
| F5 Client-Side Defense | Proteside | |
|---|---|---|
| What is checked on the payer's screen | ||
| Inventory and authorization of scripts on the payment pageThe basis of requirement 6.4.3: know what runs on the page and authorize each script. | Described in public documentation | Described in public documentation |
| Card details typed into the formStop a script from copying the number, expiry date and security code. | Described with a limitation (optional, sampled, requires human action or only in one product tier)1 | Described in public documentation |
| Pix QR code and copy-and-paste code (Brazil)Brazil's most common checkout scam: the QR code shown leads to another account. | Not found in public information | Described in public documentation |
| Boleto (Brazilian bank slip) payment lineA swapped line pays a different payee for the same amount. | Not found in public information | Described in public documentation |
| QR codes of instant payment rails worldwide (UPI, PayNow, DuitNow, PromptPay, QR Ph, FPS, CoDi, Transferencias 3.0)The same swap as Pix, across eight instant payment systems. | Not found in public information | Described in public documentation |
| Stablecoin and crypto wallet address, including when copiedA wallet address swapped on screen or in the clipboard is irreversible. | Not found in public information | Described in public documentation |
| Matches what is on screen against what the merchant issued and blocks the swap before confirmationThe check that defines payment integrity: payee and amount equal to what was issued. | Not found in public information | Described in public documentation |
| How it protects | ||
| Blocks unauthorized scripts in the buyer's browserDetecting after the fact does not bring the copied data back. | Described with a limitation (optional, sampled, requires human action or only in one product tier)2 | Described in public documentation |
| Watches real buyer sessionsTargeted scams do not show up in simulated visits. | Described in public documentation | Described in public documentation |
| Works without changing CDN, DNS or proxyDrops into any platform with one line of code. | Described with a limitation (optional, sampled, requires human action or only in one product tier)3 | Described in public documentation |
| PCI DSS compliance | ||
| Evidence for PCI DSS requirement 6.4.3Inventory, authorization and integrity of scripts. | Described in public documentation | Described in public documentation |
| Evidence for PCI DSS requirement 11.6.1Unauthorized changes to the page and its headers. | Described in public documentation | Described in public documentation |
| Exportable report for the assessor (QSA)Evidence has to leave the dashboard and reach the assessment. | Not found in public information | Described in public documentation |
- Described in public documentation
- Described with a limitation (optional, sampled, requires human action or only in one product tier)
- Not found in public information
- The vendor states it does not do this
Notes on the marks
- 1Card details typed into the form: The documentation describes alerts on sensitive field reads and a user-triggered block on form field reading; protection depends on the lists your team defines.
- 2Blocks unauthorized scripts in the buyer's browser: Mitigation works by domain list: the Mitigate List blocks a whole domain for every script, and F5's documentation states that rejecting a script is informational only, with no blocking.
- 3Works without changing CDN, DNS or proxy: Manual insertion of the script through a CMS, CDN or BIG-IP is documented for applications outside F5, but management requires the console and an F5 Distributed Cloud subscription.
Where F5 Client-Side Defense stands out
Fourth-party scripts in the inventory
The Script List covers what third-party scripts load in turn, and every approval is recorded with a written justification.
Reach beyond F5-hosted applications
The documentation describes manual insertion of the script through a CMS, CDN, load balancer or BIG-IP for applications that do not route through Distributed Cloud.
Behavior and header alerts
Beyond suspicious domains and field reads, the service flags a script that changes how it behaves and a page whose headers change.
One console for teams already on F5
Customers running an application behind a Distributed Cloud load balancer switch the service on where they already manage that application, with no code change.
What Proteside checks that F5's public material does not mention
A Bangkok retailer shows a PromptPay QR code for 2,400 baht at checkout. The shopper opens a banking app, scans and pays. If a browser extension or a compromised plugin swapped that QR for one tied to another account, same amount, the money lands elsewhere and the store finds out only when the order never clears. No card number was read; the recipient changed.
Client-Side Defense watches scripts and form field reads, and F5's documentation covers that ground carefully. For a PromptPay, UPI, PayNow or DuitNow QR code, a Brazilian bank slip line, a Pix key or a USDT wallet address, the public material does not describe any check of what the page displays. Proteside records what your server issued (QR, account details, address, amount) and compares it with what the shopper sees and copies, in every session. When they differ, confirmation is blocked and the attempt becomes an alert and a piece of evidence.
On F5, mitigation runs on lists your team maintains: the Mitigate List blocks a domain for every script, the Allow List clears one, and the documentation itself states that rejecting a script in the interface is informational only. Proteside blocks unauthorized scripts and recipient swaps in each session without a manual step, and its inventory and change history produce the evidence for requirements 6.4.3 and 11.6.1.
How each one enters your operation
F5 Client-Side Defense
- Enabled on an F5 Distributed Cloud HTTP load balancer with JavaScript insertion, or inserted by hand through a CMS, CDN, load balancer or BIG-IP.
- The documentation asks for the script to load synchronously and first on the page, and caps the service at 100 domains per namespace.
- User-defined mitigation through lists in the console; per the documentation, disabling the service in the console does not remove a manually inserted script.
Proteside
- One line of code on the payment page, on any platform, with no edge console and no CDN subscription.
- A check in every purchase session: scripts, card fields and payment details compared with what your server issued.
- Automatic blocking before confirmation, with a dashboard, an API and alerts by email, Slack, Teams and webhook.
When to choose each one
F5 Client-Side Defense makes sense when
- Your application already runs behind an F5 Distributed Cloud load balancer and the team wants a script inventory without touching code.
- You run BIG-IP or other F5 infrastructure and prefer to operate application security from a single console.
- Your security team wants to decide each mitigation by domain list, with recorded approvals and justifications.
Proteside makes sense when
- Your checkout takes UPI, PromptPay, PayNow, DuitNow, FPS, Pix, Brazilian bank slips or stablecoins, and the risk is a swapped recipient.
- You need blocking to happen in every session, before confirmation, with nobody approving a list first.
- Your operation is not on F5 and you want protection plus evidence for requirements 6.4.3 and 11.6.1 from one line of code.
Both together
A team with Client-Side Defense enabled on its F5 load balancer can keep the inventory and alerts there and add Proteside to the payment page to verify the payment itself and block a swap. The two scripts coexist, and Proteside never alters a legitimate payment.
Frequently asked questions
Does F5 Client-Side Defense cover Pix, boleto or QR codes?
Not in the public information checked in October 2026. F5's documentation describes scripts, destination domains, form field reads and headers; QR codes, instant payment rails and bank slip lines are not mentioned.
Can I use F5 Client-Side Defense and Proteside together?
Yes. The F5 script can stay inserted by the load balancer or by hand, and Proteside goes in as one line on the payment page. Each keeps its own inventory; Proteside adds the recipient check and automatic blocking.
What happens when I reject a script in the F5 console?
According to F5's documentation, rejecting a script is informational only and does not stop it from running. To block, a user adds the domain to the Mitigate List, which applies to every script from that domain. In Proteside, a script outside the authorized inventory is blocked in each session with no manual step.
Do I need to be on F5 Distributed Cloud to use Client-Side Defense?
The documentation describes two paths: enabling it on a Distributed Cloud HTTP load balancer, or inserting the script by hand through a CMS, CDN, load balancer or BIG-IP. In both cases management happens in the Distributed Cloud console under a service subscription.
Does F5 Client-Side Defense produce a report for the QSA?
Public material cites PCI DSS and telemetry for audit trails; a named QSA report is not listed in the information checked. Proteside exports the script inventory and change history for the assessment of requirements 6.4.3 and 11.6.1.
See Proteside checking your checkout
Fourteen days free, one line of code, every payment method on your page.