Get started

Activate Page Shield

To enable Page Shield:

If you do not have access to Page Shield in the Cloudflare dashboard, check if your user has one of the necessary roles.

When you enable Page Shield, it may take a while to get the list of detected scripts in your domain.

Review the scripts displayed in the Monitors dashboard, checking them for signs of malicious activity.

Depending on your plan, you may be able to also review the connections made by scripts in your domain's pages and check them for malicious activity.

Once you have activated Page Shield, you can set up multiple alerts for your domain.

Cloudflare sends alerts at regular intervals, so you might experience a delay between adding a new script and receiving an alert.

To set up alerts:

Go to Security > Page Shield.
In the Settings tab, select Manage alerts.
Select an alert type.
Enter the notification name and description.
(Optional) If you are an Enterprise customer with a paid add-on, you can define the zones for which you want to filter alerts based on the configured policies in Policies of these zones.
Select one or more notification destinations (notification email, webhooks, and connected notification services).
Select Create.

To edit, delete, or disable an alert, go to your account notifications ↗.

Policies define allowed resources on your websites. Create policies to implement a positive security model ¹.

Create a policy with the Log action.
After some time, review the list of policy violations to make sure the policy is correct. Update the policy if needed.
Change the policy action to Allow to start blocking resources not covered by the policy.

A positive security model is one that defines what is allowed and rejects everything else. In contrast, a negative security model defines what will be rejected and accepts the rest. ↩