Activity Log
[00:00:01]
✅ Script approved: cdn.example.com/app.js
[00:00:01]
✅ Script approved:
ajax.googleapis.com/jquery-3.7.0.min.js
[00:00:02] ✅ Script approved:
js.stripe.com/v3/
[00:00:03]
✅ Connection approved: api.stripe.com
[00:00:03]
✅ Connection approved: www.google-analytics.com
[00:00:04]
🍪 Cookie detected: _session (HttpOnly, Secure)
[00:00:04] 🍪 Cookie detected: _ga
(analytics)
Detected Scripts
All Approved
Detected Cookies
_session
HttpOnly ✓Secure ✓SameSite=StrictFirst-party
_ga
HttpOnly ✗Secure ✓Third-party analytics
stripe_sid
HttpOnly ✓Secure ✓SameSite=NonePayment processor
__cc_data
⚠️ New · Unknown origin
Possible data exfiltration token
Content Security Rules
script-src
'self' cdn.example.com ajax.googleapis.com
js.stripe.com
script-src
'self' cdn.example.com ajax.googleapis.com
js.stripe.com;
/* cdn.evil-tracker.io → NOT in allowlist → BLOCKED */
💡 Log rules generate
Content-Security-Policy-Report-Only headers — scripts
run but violations are reported.
💡
Enforce rules generate
Content-Security-Policy headers — unauthorized
scripts are blocked by the browser.
HTTP Response Headers injected by Cloudflare
script-src
'self'
cdn.example.com
ajax.googleapis.com
js.stripe.com;
connect-src
'self'
api.stripe.com
www.google-analytics.com;
report-uri
https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?from=pageshield
script-src
'self'
cdn.example.com
ajax.googleapis.com
js.stripe.com;
connect-src
'self'
api.stripe.com
www.google-analytics.com;
report-uri
https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?from=pageshield
/* cdn.evil-tracker.io NOT in script-src → browser
refuses to
load it */ /* exfil.evil-tracker.io NOT in connect-src →
browser blocks the fetch */
How Cloudflare injects these headers:
1. Cloudflare sits as a reverse proxy between the internet and
your origin server
2. When your server returns an HTTP response, Cloudflare adds the
CSP header before forwarding it to the browser
3. The browser enforces the CSP and sends violation reports back
to Cloudflare's reporting endpoint
4. Page Shield processes these reports to build a list of all
scripts & connections on your site
5. Enterprise ML: Cloudflare downloads each script and runs it
through classifiers for Magecart, cryptomining, and malware