Cloudflare.PageShield reference

Policy

Source: src/Cloudflare/PageShield/Policy.ts

A Page Shield policy — a Content Security Policy rule (/zones/{zone_id}/page_shield/policies) that is applied when its expression matches a request.

Policies let you enforce (or log violations of) a CSP at the edge, positively blocking resources Page Shield hasn’t approved. All fields are mutable in place; only the zone forces a replacement.

Entitlement-gated: CSP policies are an Enterprise add-on. On non-entitled zones, creation fails with the typed PolicyQuotaExceeded error (“exceeded the maximum number of rules in the phase http_response_page_shield: 1 out of 0”). Page Shield itself should be enabled on the zone first — see Cloudflare.PageShield.Settings.

Policy: Creating a Policy

Log-only CSP policy

const zone = yield* Cloudflare.Zone.Zone("Site", { name: "example.com" });

yield* Cloudflare.PageShield.Settings("PageShield", {
  zoneId: zone.zoneId,
});

yield* Cloudflare.PageShield.Policy("LogScripts", {
  zoneId: zone.zoneId,
  action: "log",
  expression: 'http.host eq "example.com"',
  value: "script-src 'self'",
});

Enforcing CSP policy with a description

yield* Cloudflare.PageShield.Policy("EnforceScripts", {
  zoneId: zone.zoneId,
  description: "block third-party scripts on checkout",
  action: "allow",
  expression: 'starts_with(http.request.uri.path, "/checkout")',
  value: "script-src 'self' https://js.stripe.com",
});

Settings

Source: src/Cloudflare/PageShield/Settings.ts

The Page Shield configuration of a Cloudflare zone (/zones/{zone_id}/page_shield).

Page Shield monitors the JavaScript and connections loaded by your visitors’ browsers to detect supply-chain attacks (e.g. Magecart). The configuration is a zone singleton — it always exists (default disabled), so this resource never creates or deletes anything physical. Reconcile PUTs the configuration when the observed flags differ from the desired ones; destroy restores the flags the zone had before Alchemy first managed them.

Script/connection monitoring data requires a Business or Enterprise zone plan, but the configuration endpoints themselves accept reads and enabled writes on lower plans. Setting useConnectionUrlPath: true or useCloudflareReportingEndpoint: false on a non-entitled zone fails with the typed NotEntitled error.

Only one Settings resource per zone makes sense — two instances managing the same zone would fight over the singleton.

Settings: Managing Page Shield

Enable Page Shield on a zone

const zone = yield* Cloudflare.Zone.Zone("Site", { name: "example.com" });

yield* Cloudflare.PageShield.Settings("PageShield", {
  zoneId: zone.zoneId,
});

Analyze connection URL paths too

yield* Cloudflare.PageShield.Settings("PageShield", {
  zoneId: zone.zoneId,
  useConnectionUrlPath: true,
});

Report CSP violations to the zone instead of Cloudflare

yield* Cloudflare.PageShield.Settings("PageShield", {
  zoneId: zone.zoneId,
  useCloudflareReportingEndpoint: false,
});