Get started with client-side security

import { Render, Steps, DashButton } from "~/components";

1. Activate client-side resource monitoring

To enable client-side resource monitoring:

1. In the Cloudflare dashboard, go to the Security Settings page.

2. (Optional) Filter by Client-side abuse.

3. Turn on Continuous script monitoring.

If you do not have access to client-side security settings in the Cloudflare dashboard, check if your user has one of the necessary roles.

2. Review detected resources

When you enable client-side resource monitoring, it may take a while to get the list of detected scripts in your domain.

To review the scripts detected by Cloudflare:

	<DashButton url="/?to=/:account/:zone/security/web-assets" />

2. Select the **Client-side resources** tab.
3. Review the list of detected scripts, checking for any unknown or unexpected scripts. [Depending on your plan and subscriptions](/client-side-security/#availability), Cloudflare will also:
	- Inform you if a script is [considered malicious](/client-side-security/how-it-works/malicious-script-detection/).
	- [Show the details](/client-side-security/detection/monitor-connections-scripts/#view-details) about each detected script.

Depending on your Cloudflare plan, you may be able to also review the connections made by scripts in your domain's pages and check them for malicious activity.

3. (Optional) Configure alerts

Once you have activated client-side security's resource monitoring, you can set up one or more alerts informing you of relevant client-side changes on your zones. The available alert types depend on your Cloudflare plan and subscriptions.

To learn how you can handle an alert, refer to Handle a client-side resource alert.

4. (Optional) Define content security rules

:::note Only available to customers with Client-Side Security Advanced. :::

Content security rules (previously called policies) define allowed resources on your websites. Create content security rules to implement a positive security model[^1].

[^1]: A positive security model is one that defines what is allowed and rejects everything else. In contrast, a negative security model defines what will be rejected and accepts the rest.

4.1. Create a content security rule with the Log action

When you create a content security rule with the Log action, Cloudflare logs any resources not covered by the rule, without blocking any resources. Use this action to validate a new rule before deploying it.

:::note Only available to customers with Client-Side Security Advanced. :::

1. In the Cloudflare dashboard, go to the Security rules page.

2. Select Create > Content security rules.

3. Enter a descriptive name for the rule in **Description**.

4. Under If incoming requests match, define the scope of the content security rule (or policy). You can use the Expression Builder (specifying one or more values for Field, Operator, and Value) or manually enter an expression using the Expression Editor. For more information, refer to Edit expressions in the dashboard.

5. Under Allow these directives, select the desired CSP directives for the content security rule by enabling one or more checkboxes.

   • To manually enter an allowed source, select Add source.

   • To refresh the displayed sources based on detected resources, select Refresh suggestions.

     :::note Cloudflare provides suggestions for Default, Scripts, and Connections directives. For the Default directive, suggestions are based on monitored scripts and connections resources. :::

6. Under Then take action, select Log.

7. To save and deploy your rule, select Deploy.

4.2. Review rule violations

Resources not covered by the content security rule you created will be reported as rule violations. After some time, review the list of rule violations to make sure the rule is correct.

Update the rule if needed.

4.3. Change rule action to Allow

Once you have verified that your content security rule is correct, change the rule action from Log to Allow.

When you use the Allow action, Cloudflare starts blocking any resources not explicitly allowed by the rule.