From 4a600522b13cb438c0d7dd4d37f1e10f34579d3c Mon Sep 17 00:00:00 2001 From: Nic <123965403+ngayerie@users.noreply.github.com> Date: Fri, 4 Sep 2026 13:34:25 +0200 Subject: [PATCH 1/3] docs(ssl): rebase onto production DEE-3623 --- .../reference/pci-dss.mdx | 21 +------------------ 1 file changed, 1 insertion(+), 20 deletions(-) diff --git a/src/content/docs/client-side-security/reference/pci-dss.mdx b/src/content/docs/client-side-security/reference/pci-dss.mdx index 1d4b1c7ab9c..daa2ad2e628 100644 --- a/src/content/docs/client-side-security/reference/pci-dss.mdx +++ b/src/content/docs/client-side-security/reference/pci-dss.mdx @@ -1,20 +1 @@ ---- -title: Client-side security and PCI DSS compliance -pcx_content_type: reference -description: Use client-side security to meet PCI DSS v4 requirements 6.4.3 and 11.6.1. -products: - - client-side-security -sidebar: - order: 4 - label: PCI DSS compliance -tags: - - Compliance ---- - -You can use Cloudflare's client-side security for PCI DSS v4's client-side security requirements (items 6.4.3 and 11.6.1). - -Refer to the [PCI DSS v.4.0 Evaluation](https://cfl.re/4dhk8Gx) whitepaper for details on how you can use Cloudflare's client-side security to meet the new v4 requirements. - -:::note -To help with PCI DSS requirements, you must have Client-Side Security Advanced. Refer to [Availability](/client-side-security/#availability) for details on what is included in each package. -::: +H@ ë·µq®7õÿuãǺӇ·÷Ÿi¾µoƺAˆ6Ê.­Ç \ No newline at end of file From 8a9fa14be604b142c5010b027d8590c36c068834 Mon Sep 17 00:00:00 2001 From: Nic <123965403+ngayerie@users.noreply.github.com> Date: Fri, 4 Sep 2026 14:27:41 +0200 Subject: [PATCH 2/3] docs(ssl): fix corrupted file content after rebase DEE-3623 --- .../reference/pci-dss.mdx | 53 ++++++++++++++++++- 1 file changed, 52 insertions(+), 1 deletion(-) diff --git a/src/content/docs/client-side-security/reference/pci-dss.mdx b/src/content/docs/client-side-security/reference/pci-dss.mdx index daa2ad2e628..c3311717f64 100644 --- a/src/content/docs/client-side-security/reference/pci-dss.mdx +++ b/src/content/docs/client-side-security/reference/pci-dss.mdx @@ -1 +1,52 @@ -H@ ë·µq®7õÿuãǺӇ·÷Ÿi¾µoƺAˆ6Ê.­Ç \ No newline at end of file +--- +title: Client-side security and PCI DSS compliance +pcx_content_type: reference +description: Use Cloudflare's client-side security to meet PCI DSS v4.0 requirements 6.4.3 and 11.6.1 for payment page script management and tamper detection. +products: + - client-side-security +sidebar: + order: 4 + label: PCI DSS compliance +tags: + - Compliance +--- + +PCI DSS v4.0 introduced two requirements that apply to scripts running in the consumer's browser on payment pages. Cloudflare's client-side security helps you meet both. + +:::note +Client-Side Security Advanced is required to meet PCI DSS requirements 6.4.3 and 11.6.1. Refer to [Availability](/client-side-security/#availability) for plan details. +::: + +## Requirements + +### Requirement 6.4.3 — Payment page script management + +Requirement 6.4.3 applies to all scripts that a payment page loads into the consumer's browser, regardless of whether those scripts are first-party or third-party. + +| Control objective | What it requires | How client-side security addresses it | +| --- | --- | --- | +| Script inventory | A documented inventory of all scripts loaded to a payment page | The **Monitor resources** view lists every script loaded on monitored pages, including third-party scripts | +| Business justification | A written justification (business or technical) for each script | You can review scripts in the dashboard and export the inventory for annotation to document each script's purpose | +| Authorization method | A method to confirm that each script is authorized | Content security rules block or report scripts that are not explicitly allowed | + +### Requirement 11.6.1 — Tamper detection for payment pages + +Requirement 11.6.1 requires a mechanism that detects unauthorized modifications to your payment pages and their security headers. + +| Control objective | What it requires | How client-side security addresses it | +| --- | --- | --- | +| Tamper detection | Detect unauthorized changes to HTTP security headers and payment page content | Alerts fire when scripts, connections, or cookies on a monitored payment page change. Cloudflare's detection runs continuously — no manual scheduling is required. Refer to the [PCI DSS v4.0 Evaluation](https://cfl.re/4dhk8Gx) whitepaper for the full requirement mapping | + +## Get started + +1. Follow [Get started with client-side security](/client-side-security/get-started/) to enable monitoring on your payment pages. +2. Use [Monitor resources and cookies](/client-side-security/detection/monitor-connections-scripts/) to review the full inventory of scripts and connections detected on those pages. +3. Classify and approve each script to build your authorized inventory for requirement 6.4.3. +4. Configure [alerts](/client-side-security/alerts/) to receive notifications when unauthorized changes are detected (requirement 11.6.1). +5. Deploy [rules](/client-side-security/rules/) to enforce your script policy and block unauthorized scripts. + +For a detailed mapping of client-side security features to PCI DSS v4.0 controls, refer to the [PCI DSS v4.0 Evaluation](https://cfl.re/4dhk8Gx) whitepaper. + +## Related resources + +For related resources, refer to the [PCI DSS compliance](/ssl/reference/compliance-and-vulnerabilities/) guide to configure TLS version and cipher suites to meet PCI DSS requirement 4.2.1, and the [Cloudflare Trust Hub](https://www.cloudflare.com/trust-hub/compliance-resources/pci-dss/) to obtain Cloudflare's Attestation of Compliance (AOC) for your QSA. From 3d11432e723a344a530f012471c2c36b71450681 Mon Sep 17 00:00:00 2001 From: Nic <123965403+ngayerie@users.noreply.github.com> Date: Sat, 5 Sep 2026 11:56:38 +0200 Subject: [PATCH 3/3] docs(ssl): fix 11.6.1 table wording to match documented capabilities DEE-3623 - Replace overclaiming "HTTP security headers and payment page content" with "monitored client-side resources on payment pages" - Replace "Alerts fire when scripts, connections, or cookies...change" with "Alerts can identify changes to monitored client-side resources" - Removes undocumented header/cookie-change alerting claim --- src/content/docs/client-side-security/reference/pci-dss.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/client-side-security/reference/pci-dss.mdx b/src/content/docs/client-side-security/reference/pci-dss.mdx index c3311717f64..d2e5b6b820f 100644 --- a/src/content/docs/client-side-security/reference/pci-dss.mdx +++ b/src/content/docs/client-side-security/reference/pci-dss.mdx @@ -35,7 +35,7 @@ Requirement 11.6.1 requires a mechanism that detects unauthorized modifications | Control objective | What it requires | How client-side security addresses it | | --- | --- | --- | -| Tamper detection | Detect unauthorized changes to HTTP security headers and payment page content | Alerts fire when scripts, connections, or cookies on a monitored payment page change. Cloudflare's detection runs continuously — no manual scheduling is required. Refer to the [PCI DSS v4.0 Evaluation](https://cfl.re/4dhk8Gx) whitepaper for the full requirement mapping | +| Tamper detection | Detect unauthorized changes to monitored client-side resources on payment pages | Alerts can identify changes to monitored client-side resources on payment pages. Cloudflare's detection runs continuously — no manual scheduling is required. Refer to the [PCI DSS v4.0 Evaluation](https://cfl.re/4dhk8Gx) whitepaper for the full requirement mapping | ## Get started