Imperva Client-Side Protection vs Proteside: script policy at the WAF or verification of the payment itself?
By Laís Peixoto
Growth Marketer, Proteside
Published
Imperva Client-Side Protection is built for companies already on Imperva Cloud Application Security that want to govern payment page scripts from the console they run today, with no code. Proteside is for merchants who accept cards, instant payments, bank slips or crypto and need every QR code, account and wallet address on screen checked against what they issued.
Side by side
- How it describes itself
- A component of Imperva Web Application & API Protection that prevents data theft through scripts on the page, per the datasheet.
- Headquarters
- Imperva: United States, with more than one address across public sources. Part of the Thales group (France) since December 2023.
- How it enters the site
- One-click activation inside Imperva Cloud Application Security with no code changes; the browser enforces a content security policy set at the server.
- What it checks on the payment page
- JavaScript services on the page (continuous inventory, country of origin, certificate status, location within the code), form data and security headers.
- PCI DSS
- Requirements 6.4.3 and 11.6.1, with a PCI dashboard that explains each requirement and lists action items, plus weekly summaries of payment page changes.
Imperva Client-Side Protection
- How it describes itself
- Cybersecurity layer for the moment of payment: integrity of what the buyer sees, copies and confirms.
- Headquarters
- São Paulo, Brazil. Operating since 2026.
- How it enters the site
- One line of code on the payment page, or an integration in the platform or payment provider template. No proxy, no DNS or CDN change.
- What it checks on the payment page
- Third-party scripts, card form, Pix QR code and key, boleto (Brazilian bank slip) line, crypto wallet address and the QR codes of eight instant payment rails, matched against what the merchant issued.
- PCI DSS
- Evidence for PCI DSS requirements 6.4.3 and 11.6.1, with an exportable report for the QSA.
Proteside
Criterion by criterion
Marks are based on each vendor's public documentation. Hover over or tap a mark to read the legend.
| Imperva Client-Side Protection | Proteside | |
|---|---|---|
| What is checked on the payer's screen | ||
| Inventory and authorization of scripts on the payment pageThe basis of requirement 6.4.3: know what runs on the page and authorize each script. | Described in public documentation | Described in public documentation |
| Card details typed into the formStop a script from copying the number, expiry date and security code. | Described in public documentation | Described in public documentation |
| Pix QR code and copy-and-paste code (Brazil)Brazil's most common checkout scam: the QR code shown leads to another account. | Not found in public information | Described in public documentation |
| Boleto (Brazilian bank slip) payment lineA swapped line pays a different payee for the same amount. | Not found in public information | Described in public documentation |
| QR codes of instant payment rails worldwide (UPI, PayNow, DuitNow, PromptPay, QR Ph, FPS, CoDi, Transferencias 3.0)The same swap as Pix, across eight instant payment systems. | Not found in public information | Described in public documentation |
| Stablecoin and crypto wallet address, including when copiedA wallet address swapped on screen or in the clipboard is irreversible. | Not found in public information | Described in public documentation |
| Matches what is on screen against what the merchant issued and blocks the swap before confirmationThe check that defines payment integrity: payee and amount equal to what was issued. | Not found in public information | Described in public documentation |
| How it protects | ||
| Blocks unauthorized scripts in the buyer's browserDetecting after the fact does not bring the copied data back. | Described in public documentation | Described in public documentation |
| Watches real buyer sessionsTargeted scams do not show up in simulated visits. | Described in public documentation | Described in public documentation |
| Works without changing CDN, DNS or proxyDrops into any platform with one line of code. | The vendor states it does not do this1 | Described in public documentation |
| PCI DSS compliance | ||
| Evidence for PCI DSS requirement 6.4.3Inventory, authorization and integrity of scripts. | Described in public documentation | Described in public documentation |
| Evidence for PCI DSS requirement 11.6.1Unauthorized changes to the page and its headers. | Described in public documentation | Described in public documentation |
| Exportable report for the assessor (QSA)Evidence has to leave the dashboard and reach the assessment. | Described in public documentation | Described in public documentation |
- Described in public documentation
- Described with a limitation (optional, sampled, requires human action or only in one product tier)
- Not found in public information
- The vendor states it does not do this
Notes on the marks
- 1Works without changing CDN, DNS or proxy: The datasheet presents Client-Side Protection as part of the Imperva Cloud Application Security stack, activated in one click with no code. Public documentation does not describe an installation path outside that platform; the site needs to be served through it.
Where Imperva Client-Side Protection stands out
Blocked by default until authorized
The datasheet describes a model in which any new service, or any change, stays blocked until it is reviewed and authorized. Teams with strict change control get a clear posture out of the box.
Instant Block inside the browser
The product page describes Instant Block, which uses a browser component (a service worker) sitting between the page and the server to cut a service off right away, without waiting for the next policy update.
Infrastructure as code
Full Terraform support, per the datasheet. Teams that version their Imperva WAF configuration can treat script policy the same way.
Context for every script decision
A domain risk score, an AI-written explanation of what each script does (AI Explain), and inventory details such as origin country, certificate status and position in the code.
What Proteside checks that Imperva's public material does not mention
A Singapore retailer shows a PayNow QR code for a S$ 1,250 order. The customer scans it with a banking app, sees the amount, confirms. A browser extension on the customer's laptop had redrawn the QR code to point at a different UEN with the same amount. No new script loaded on the page. No card data left the browser. The service inventory stays clean, and the money has already moved.
Imperva does well what it was designed to do: know which services run on the page, block the unknown ones and keep PCI DSS evidence in order. For PayNow, UPI, PromptPay, DuitNow, FPS, Pix, Brazilian bank slips and crypto wallet addresses, Imperva's public documentation does not describe a check of what the shopper actually sees. Proteside records what your server issued for each charge and compares it with what is rendered and what is copied in every session. If they differ, the confirmation stops before it happens and the attempt is logged as an alert and as evidence.
The same script keeps the script inventory, protects the card form and stores the history that requirements 6.4.3 and 11.6.1 call for. Installation is one line of code on the payment page, on any platform, with or without a WAF in front.
How each one enters your operation
Imperva Client-Side Protection
- One-click activation inside Imperva Cloud Application Security; no code changes on the page.
- Starts in Discovery mode, which inventories services and alerts on new ones and on data transfers; the policy then blocks anything not yet authorized.
- Alerts by email, API and SIEM; configuration also available through Terraform.
Proteside
- One line of code on the payment page, on any platform, or a single integration in the platform's or payment provider's template.
- Every checkout session is checked: QR codes, account identifiers, bank slip lines, wallet addresses and card fields, against what the server issued.
- Blocking before confirmation; dashboard, API and alerts by email, Slack, Teams and webhook. Works alongside any CDN or WAF.
When to choose each one
Imperva Client-Side Protection makes sense when
- Your site already runs on Imperva Cloud Application Security and the security team wants script policy in the console it already operates.
- Your internal rule is to hold anything new until someone approves it, and cards are the payment method on the page.
- Security configuration lives in Terraform and script policy needs to follow the same workflow.
Proteside makes sense when
- The page accepts instant payments such as UPI, PayNow, PromptPay or DuitNow, Brazilian bank slips or crypto, and you need the displayed payee verified.
- The site sits on another CDN, on your own CDN or on none, and you do not want to change how traffic is delivered to protect checkout.
- You want protection and evidence for requirements 6.4.3 and 11.6.1 in one install, in minutes, without a project.
Both together
A company already on Imperva Cloud Application Security can keep Imperva's script policy and add Proteside on the payment page to verify the payment itself. Proteside shows up as one more service in Imperva's inventory: authorize it once and both run on the same page.
Frequently asked questions
Does Imperva Client-Side Protection cover Pix, boleto or QR codes?
Not in the public information reviewed in October 2026. Imperva's material describes JavaScript services, data typed into forms and security headers; Pix, boleto (the Brazilian bank slip) and payment QR codes are not mentioned.
Can Imperva Client-Side Protection and Proteside be used together?
Yes. Proteside is a script on the payment page and appears in Imperva's inventory as a service to authorize. After that, Imperva keeps governing scripts and Proteside verifies the payment. Neither one alters a legitimate payment.
Do I need to be on Imperva's WAF to use Client-Side Protection?
Public documentation describes activation inside Imperva Cloud Application Security and does not describe another installation path. Proteside installs with one line of code on any site, behind any CDN or WAF, including Imperva's.
Does Imperva's block-until-authorized model get in the way of checkout?
Imperva's material describes an initial Discovery mode that only inventories and alerts, before the policy starts blocking what has not been authorized. Proteside takes a different route: known scripts are authorized and the payment content is checked in every session, with no new service held by default.
How can I try Proteside without touching Imperva?
Sign up for the fourteen-day free trial, add one line of code to the payment page and authorize the script in Imperva's inventory. Within minutes the Proteside dashboard shows the page's scripts, its payment methods and any blocked attempts.
See Proteside checking your checkout
Fourteen days free, one line of code, every payment method on your page.