Page Protection

Track third party scripts and page security headers to protect your page from malicious changes.

Evervault Page Protection helps protect companies from sophisticated card data breaches, while directly addressing new requirements in PCI DSS Version 4:

With monitoring and alerting, you'll detect potentially malicious JavaScript changes before they impact your customers — without the noise.

Getting Started

In the Compliance tab in the Evervault dashboard click Add Page

Specify the expected URL where it will be hosted, and an optional name to help identify the page.

To enable monitoring, follow the quickstart steps to add a script tag to your page:

Once deployed, any third party script or security header changes made on your page will be tracked by Evervault.

Enable Alerts

To receive alerts for changes to your page, enable Page Protection events by navigating to App → Settings → Webhooks → Create Endpoint. Slack and standard webhooks are supported.

Select the following events:

Monitoring

Once our script detects a change, you will see new issues appear on the Open issues tab:

A screenshot of the open issues tab. A list of issues are shown, each with a diff of changes. Each issue has a text field to add a reason for the change, and an "Approve" button.

Review and approve each issue that's been detected, providing a reason for the change if you have one.

Reasons are only required when new scripts are added to the page. However, it's a good rule of thumb to add a reason for the change for auditing purposes if you can identify it.

Once approved, the issue will be marked as resolved. You can see all resolved issues in the Resolved tab, including the reviewer and reason for the change:

A screenshot of the resolved issues tab. A list of resolved issues are shown, including the reviewer and reason for the change.

Auditing

All scripts and headers detected are stored for auditing purposes. From each inventory tab, you can export a CSV of all scripts and headers detected.

Scripts

Under the Scripts tab, you can see an inventory of all scripts detected on the page.

Click on a script to see its details, including the latest source code, reason for approval, and the history of changes and reviews:

A screenshot of the scripts tab. A list of scripts are shown, each with the source URL. A drawer is open with details about a specific script for Google Analytics. The latest source code, reason for approval, and the history of changes and reviews are shown.

Headers

Under the Headers tab, you can see an inventory of all security headers detected on the page.

You can copy the latest headers to your clipboard, or navigate the history of changes:

A screenshot of the headers tab. Two headers, X-Content-Type-Options and X-Frame-Options, are listed. The latest value for each is shown, and a history of changes is shown in a table.

FAQs

How does Page Protection work?

Page Protection works by intercepting requests to all third-party scripts on your page (yes, even our own!). If a script is detected as new or has changed, you will receive an alert.

We also monitor changes to security headers that have changed on your page.

Which headers does Evervault monitor?

We only monitor security headers that are used to protect against attacks like XSS and clickjacking:

Does Page Protection track self-hosted scripts?

Any scripts that are hosted on your own domain are not tracked by Page Protection. This includes any third-party code that is installed via a package manager like npm and bundled with your application.

Since these scripts are part of your static application bundle, they can be analyzed before deployment. We recommend using code analysis tools during your build process to monitor for potential security threats.

OWASP maintains a list of source code analysis tools.

Can I enable Page Protection on localhost?

Yes, you can enable Page Protection on localhost. You will need to add the following attribute to your monitoring script tag:

You can also enable debug logs with the following attribute:

What should I do if I don't recognize a change?

If you don't recognize a change we've detected, don't resolve the issue just yet. Follow these steps:

If a new script is added, confirm with your engineering team if this script was expected to be added. If not, another script may have loaded it.
If a script has been updated, we recommend checking with the third-party script provider what changes they included. You should also confirm with your engineering team if this change is safe, or the script should be removed.
If your security headers have been updated, confirm with your engineering team if this change was expected. If not, your team may need to update their security configuration.

Once you've confirmed the change, include the reason in your review and resolve the issue.