HUMAN Security vs Proteside: script control or payment verification?
By Laís Peixoto
Growth Marketer, Proteside
Published
HUMAN Client-Side Defense suits companies already on the HUMAN platform for bot and fraud defense that want payment page scripts governed with action-level blocking. Proteside suits merchants who take UPI, PromptPay, PayNow, cards, stablecoins or Brazilian Pix and need to know the QR, account or wallet address on screen is the one they issued, with script inventory included.
Side by side
- How it describes itself
- PCI DSS compliance and payment page protection through script control, part of HUMAN's Application Protection suite.
- Headquarters
- New York, United States. Founded in 2012 as White Ops; merged with PerimeterX in 2022.
- How it enters the site
- A single line of JavaScript, the HUMAN Sensor, running in every visitor's browser; a cartridge is available for Salesforce Commerce Cloud.
- What it checks on the payment page
- Risk-scored script inventory, script behavior, card form data and HTTP headers.
- PCI DSS
- Requirements 6.4.3 and 11.6.1, with on-demand audit reports. Principal Participating Organization of the PCI SSC since March 2024, per the council's public list.
HUMAN Client-Side Defense
- How it describes itself
- Cybersecurity layer for the moment of payment: integrity of what the buyer sees, copies and confirms.
- Headquarters
- São Paulo, Brazil. Operating since 2026.
- How it enters the site
- One line of code on the payment page, or an integration in the platform or payment provider template. No proxy, no DNS or CDN change.
- What it checks on the payment page
- Third-party scripts, card form, Pix QR code and key, boleto (Brazilian bank slip) line, crypto wallet address and the QR codes of eight instant payment rails, matched against what the merchant issued.
- PCI DSS
- Evidence for PCI DSS requirements 6.4.3 and 11.6.1, with an exportable report for the QSA.
Proteside
Criterion by criterion
Marks are based on each vendor's public documentation. Hover over or tap a mark to read the legend.
| HUMAN Security | Proteside | |
|---|---|---|
| What is checked on the payer's screen | ||
| Inventory and authorization of scripts on the payment pageThe basis of requirement 6.4.3: know what runs on the page and authorize each script. | Described in public documentation | Described in public documentation |
| Card details typed into the formStop a script from copying the number, expiry date and security code. | Described in public documentation | Described in public documentation |
| Pix QR code and copy-and-paste code (Brazil)Brazil's most common checkout scam: the QR code shown leads to another account. | Not found in public information | Described in public documentation |
| Boleto (Brazilian bank slip) payment lineA swapped line pays a different payee for the same amount. | Not found in public information | Described in public documentation |
| QR codes of instant payment rails worldwide (UPI, PayNow, DuitNow, PromptPay, QR Ph, FPS, CoDi, Transferencias 3.0)The same swap as Pix, across eight instant payment systems. | Not found in public information | Described in public documentation |
| Stablecoin and crypto wallet address, including when copiedA wallet address swapped on screen or in the clipboard is irreversible. | Not found in public information | Described in public documentation |
| Matches what is on screen against what the merchant issued and blocks the swap before confirmationThe check that defines payment integrity: payee and amount equal to what was issued. | Not found in public information | Described in public documentation |
| How it protects | ||
| Blocks unauthorized scripts in the buyer's browserDetecting after the fact does not bring the copied data back. | Described in public documentation | Described in public documentation |
| Watches real buyer sessionsTargeted scams do not show up in simulated visits. | Described in public documentation | Described in public documentation |
| Works without changing CDN, DNS or proxyDrops into any platform with one line of code. | Described in public documentation | Described in public documentation |
| PCI DSS compliance | ||
| Evidence for PCI DSS requirement 6.4.3Inventory, authorization and integrity of scripts. | Described in public documentation | Described in public documentation |
| Evidence for PCI DSS requirement 11.6.1Unauthorized changes to the page and its headers. | Described in public documentation | Described in public documentation |
| Exportable report for the assessor (QSA)Evidence has to leave the dashboard and reach the assessment. | Described in public documentation | Described in public documentation |
- Described in public documentation
- Described with a limitation (optional, sampled, requires human action or only in one product tier)
- Not found in public information
- The vendor states it does not do this
Where HUMAN Security stands out
Blocks the action, keeps the script
The datasheet describes stopping a risky action, such as reading a form field, without interrupting the useful work the script does. That is finer control than allowing or denying a whole script.
Risk-scored inventory
Every script gets a risk score, with authorization, justification and integrity checks recorded for requirement 6.4.3.
Same platform as bot and fraud defense
The product sits inside HUMAN's Application Protection suite, alongside bot management, account abuse and fraud. Teams already running that platform get the payment page in the same console.
PerimeterX lineage
The product started as Code Defender at PerimeterX and keeps that name in the technical documentation; the sensor has years of history observing real browser sessions.
What Proteside checks that HUMAN's material does not mention
An online pharmacy in Bengaluru shows a UPI QR for INR 3,200. The customer scans it with a banking app, sees the amount, and confirms. A compromised plugin had swapped the QR for one tied to a different virtual payment address, same amount, same merchant name. The money leaves the customer's account, the order never settles, and the store only finds out when the customer calls.
The HUMAN Sensor watches script behavior and blocks risky actions against card data, and it does so with precision. For a UPI, PromptPay, PayNow, DuitNow or FPS QR, a Pix key, a Brazilian bank slip (boleto) number or a stablecoin wallet address, HUMAN's public documentation does not describe comparing what the merchant issued with what the buyer sees. Proteside records every charge your server issues and checks the QR, account, address and amount on the buyer's screen, including the moment they copy it. On a mismatch, confirmation is blocked and the attempt becomes an alert and a piece of evidence.
Script inventory, blocking of unauthorized scripts and the change history for the page and its headers stay in that same Proteside script, with the report that requirements 6.4.3 and 11.6.1 call for. One line installed, two jobs covered.
How each one enters your stack
HUMAN Security
- A single line of JavaScript, the HUMAN Sensor, on every monitored page; a ready-made cartridge for Salesforce Commerce Cloud.
- Authorization and mitigation policies set in the HUMAN console; script and header alerts, on-demand audit reports, and integrations with SIEM and ticketing tools.
- Delivered as part of the Application Protection suite, next to bot and fraud defense.
Proteside
- One line of code on the payment page, on any platform, or a single integration in the platform's or payment provider's template.
- Verification in every session, across every payment method on the page, with no sampling and no specific CDN or proxy required.
- Automatic blocking before confirmation; dashboard, API and alerts by email, Slack, Teams and webhook.
When to pick each one
HUMAN Security makes sense when
- Your operation already runs on HUMAN's platform for bots and fraud, and you want the payment page managed by the same team in the same console.
- Cards are your main payment method and you want to stop specific actions by a third-party script without removing it from the page.
- Your store runs on Salesforce Commerce Cloud and the ready-made cartridge cuts installation work.
Proteside makes sense when
- Your checkout takes UPI, PromptPay, PayNow, DuitNow, FPS, stablecoins or Pix, and the risk is a swapped payee.
- You need a swapped QR, account or wallet address blocked in real sessions, before the customer pays.
- You want protection and evidence for requirements 6.4.3 and 11.6.1 from one line of code, without adopting a full suite.
Both together
A company on HUMAN's platform can keep Client-Side Defense governing its scripts and add Proteside on the payment page to verify the payment itself. The two sensors coexist on the same page; Proteside does not alter legitimate payments and does not interfere with another tool's inventory.
Frequently asked questions
Does HUMAN Client-Side Defense cover UPI, PromptPay, Pix or QR codes?
Not in the public information reviewed in October 2026. The datasheet and the Code Defender documentation describe scripts, script behavior, form data and HTTP headers.
Can HUMAN Client-Side Defense and Proteside run together?
Yes. They are two independent scripts on the payment page. Proteside verifies payment data and scripts; the HUMAN Sensor keeps enforcing its own policies. Neither requires a specific CDN or proxy.
Are Code Defender and Client-Side Defense the same product?
Yes. Code Defender is the name the product carried at PerimeterX and the one HUMAN's technical documentation still uses; Client-Side Defense is the current commercial name, inside the Application Protection suite.
What is the granular blocking HUMAN describes?
Per the datasheet, it means stopping a risky action by a script, such as access to a form field, without disabling the whole script. Proteside blocks unauthorized scripts and, on top of that, blocks confirmation when the QR, account or wallet address differs from what was issued.
Does Proteside replace HUMAN's bot defense?
No. Bot and fraud defense judges whether the traffic and the buyer are legitimate. Proteside makes sure the page and the payment data were not swapped. They are different layers and can coexist.
See Proteside checking your checkout
Fourteen days free, one line of code, every payment method on your page.